Common Weakness Enumeration
CWE-284
DiscouragedImproper Access Control
Abstraction: Pillar · Status: Incomplete
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
11091 vulnerabilities reference this CWE, most recent first.
GCVE-1-2026-20248 (CVE-2026-104914)
Vulnerability from gna-1 – Published: 2026-10-02 16:09 – Updated: 2026-10-02 16:09
VLAI
EPSS
VEX
Title
MISP: Soft-Deleted Attributes from Other Organizations Exposed via Attribute Search and Paginated View
Summary
MISP contains an improper access control vulnerability in its attribute search and paginated attribute view endpoints.
When a user queries for soft-deleted attributes (e.g., via the deleted-attributes search or the paginated attribute listing), the application returned soft-deleted attributes belonging to events owned by other organizations to any authenticated user who had visibility of the event. The event detail view correctly restricted soft-deleted attribute visibility to the owning organization and sync-permission users, but the attribute search and paginated view code paths lacked this restriction.
Preconditions:
- An authenticated MISP user with at least read access to an event owned by another organization.
- The user issues a query for deleted attributes (search or paginated view with the deleted filter).
Impact:
- Confidentiality: Soft-deleted threat intelligence attributes (e.g., IOCs, indicators, context) from other organizations are disclosed to unauthorized users. This may expose sensitive intelligence that the owning organization intended to remove from general visibility.
Affected versions: MISP versions prior to v2.5.48.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
Supplier · CNA (v2.0.3)
Decision recorded 2026-10-02 16:06 UTC
References
2 references
Impacted products
GCVE extensions
AI-generated
Human-reviewed
Confidence: medium
Model
qwen3.8:27b
1 event
advisory
bcp-05-x-01bcp-05-x-02bcp-05-x-03
Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.
ai-computer-assisted:llm-generatedai-computer-assisted:classification
| Model | Source | Identifier |
|---|---|---|
| qwen3.8:27b | ollama | qwen3.8:27b |
- Generator
-
patch2vuln.pyon 2026-10-02 16:06 - Model
qwen3.8:27b- Input
-
https://github.com/MISP/MISP/commit/bd81c23cf.patch
9673ee1d4db2… - Confidence
- medium
| Commit | Subject | Patch SHA-256 |
|---|---|---|
bd81c23cf2ac
|
fix: [security] Show soft-deleted attributes only to the | 9673ee1d4db2… |
Fix summary
The fix enforces organizational ownership checks on soft-deleted attribute queries. When a user without sync permission requests deleted attributes, the query is now constrained to only return soft-deleted attributes whose parent event belongs to the requesting user's organization. This aligns the attribute search and paginated view behavior with the existing event view authorization logic.
Patch summary
Two code paths were modified:1. Event.php (fetchPaginatedAttributes): When the deleted filter is active and the user lacks perm_sync, an additional subquery condition is appended requiring the event owner's org_id to match the user's org_id. The original blanket deleted=0 or deleted=1 condition is replaced with an OR/AND structure that permits non-deleted attributes for all users but restricts deleted attributes to the owning org.2. MispAttribute.php (fetchAttributes): In the deleted='only' branch, when the user lacks perm_sync, an additional AND condition Event.org_id = user.org_id is added to the query conditions, scoping results to the user's own organization.
CVSS rationale
AV:N: The vulnerability is exploitable over the network via the MISP web API. AC:L: Exploitation requires only a standard query with the deleted-attribute filter; no race conditions or complex setup. AT:N: No special attack requirements. PR:L: An authenticated user with at least read access to an event owned by another organization is required. UI:N: No victim interaction needed; the data is returned in the API response. VC:L: Confidentiality impact is limited to soft-deleted attributes (a subset of event data) from other organizations; not all data is exposed. VI:N, VA:N: No integrity or availability impact on the vulnerable component. SC:N, SI:N, SA:N: No impact on subsequent components.
Weakness rationale
- CWE-862 The attribute search and paginated view code paths were missing the authorization check that restricts soft-deleted attribute visibility to the owning organization. The event view had this check, but the attribute-level query paths did not, allowing any user with event visibility to retrieve soft-deleted attributes from other organizations.
- CWE-284 More broadly, the application failed to enforce proper access control boundaries between organizations when serving soft-deleted attribute data through specific query endpoints, resulting in cross-organizational information disclosure.
Attack pattern rationale
- CAPEC-126 This CAPEC describes leveraging legitimate application code paths to access or manipulate data beyond intended permissions. The attacker uses the legitimate attribute search and paginated view endpoints (executable code paths) to retrieve soft-deleted attributes from other organizations. The mapping is imperfect because CAPEC-126 emphasizes data alteration, whereas this vulnerability is purely an information disclosure. However, among available CAPEC patterns, this is the closest match for exploiting a legitimate code path to bypass intended access restrictions. No CAPEC specifically covers 'information disclosure via missing authorization in a query endpoint' with greater precision.
Assumptions to verify
- The exact fixed version is not specified in the patch metadata; the fix commit is 37 commits after the v2.5.48 tag, so the fixed release is post-2.5.48 but the exact version number is unknown.
- PR:L assumes the attacker needs at least read access to an event owned by another organization; if MISP deployments restrict cross-org event visibility more tightly, the effective privilege requirement may be higher.
- CAPEC-126 is the closest available mapping but is not a perfect fit; the vulnerability is an information disclosure via missing authorization rather than data alteration.
- VC:L assumes the exposure is limited to soft-deleted attributes (a subset of event data) and does not include active attributes or full event metadata.
- The patch does not specify whether this affects all MISP deployments or only multi-organization configurations; the CVSS assumes a multi-org deployment where cross-org visibility is possible.
Model comparison
Selected qwen3.8:27b
by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.
| Model | Score | Agreement | Confidence | Assumptions |
|---|---|---|---|---|
qwen3.8:27b |
7 | 11 | medium | 5 |
- 2026-09-24 11:57 UTC Fix developed Corrective change authored (bd81c23cf2aced3c72766369dc813612edd52509): fix: [security] Show soft-deleted attributes only to the https://github.com/MISP/MISP/commit/bd81c23cf.patch
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
],
"modules": [
"app/Model/Event.php",
"app/Model/MispAttribute.php"
],
"product": "MISP",
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThan": "2.5.48",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5.5 (1M context)"
},
{
"lang": "en",
"type": "reporter",
"value": "elhoim"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMISP contains an improper access control vulnerability in its attribute search and paginated attribute view endpoints.\u003c/p\u003e\u003cp\u003eWhen a user queries for soft-deleted attributes (e.g., via the deleted-attributes search or the paginated attribute listing), the application returned soft-deleted attributes belonging to events owned by other organizations to any authenticated user who had visibility of the event. The event detail view correctly restricted soft-deleted attribute visibility to the owning organization and sync-permission users, but the attribute search and paginated view code paths lacked this restriction.\u003c/p\u003e\u003cp\u003ePreconditions:\u003c/p\u003e\u003cp\u003e- An authenticated MISP user with at least read access to an event owned by another organization.\u003c/p\u003e\u003cp\u003e- The user issues a query for deleted attributes (search or paginated view with the deleted filter).\u003c/p\u003e\u003cp\u003eImpact:\u003c/p\u003e\u003cp\u003e- Confidentiality: Soft-deleted threat intelligence attributes (e.g., IOCs, indicators, context) from other organizations are disclosed to unauthorized users. This may expose sensitive intelligence that the owning organization intended to remove from general visibility.\u003c/p\u003e\u003cp\u003eAffected versions: MISP versions prior to v2.5.48.\u003c/p\u003e"
}
],
"value": "MISP contains an improper access control vulnerability in its attribute search and paginated attribute view endpoints.\n\nWhen a user queries for soft-deleted attributes (e.g., via the deleted-attributes search or the paginated attribute listing), the application returned soft-deleted attributes belonging to events owned by other organizations to any authenticated user who had visibility of the event. The event detail view correctly restricted soft-deleted attribute visibility to the owning organization and sync-permission users, but the attribute search and paginated view code paths lacked this restriction.\n\nPreconditions:\n\n- An authenticated MISP user with at least read access to an event owned by another organization.\n\n- The user issues a query for deleted attributes (search or paginated view with the deleted filter).\n\nImpact:\n\n- Confidentiality: Soft-deleted threat intelligence attributes (e.g., IOCs, indicators, context) from other organizations are disclosed to unauthorized users. This may expose sensitive intelligence that the owning organization intended to remove from general visibility.\n\nAffected versions: MISP versions prior to v2.5.48."
}
],
"impacts": [
{
"capecId": "CAPEC-126",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-126 Leverage Executable Code to Alter Data"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"format": "SSVC",
"other": {
"content": {
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "Supplier",
"timestamp": "2026-10-02T16:06:38Z",
"version": "2.0.3"
},
"type": "SSVC"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "00000000-0000-4000-9000-000000000000"
},
"references": [
{
"name": "Security patch",
"tags": [
"patch"
],
"url": "https://github.com/MISP/MISP/commit/bd81c23cf"
},
{
"url": "https://github.com/elhoim"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe fix enforces organizational ownership checks on soft-deleted attribute queries. When a user without sync permission requests deleted attributes, the query is now constrained to only return soft-deleted attributes whose parent event belongs to the requesting user\u0027s organization. This aligns the attribute search and paginated view behavior with the existing event view authorization logic.\u003c/p\u003e"
}
],
"value": "The fix enforces organizational ownership checks on soft-deleted attribute queries. When a user without sync permission requests deleted attributes, the query is now constrained to only return soft-deleted attributes whose parent event belongs to the requesting user\u0027s organization. This aligns the attribute search and paginated view behavior with the existing event view authorization logic."
}
],
"title": "MISP: Soft-Deleted Attributes from Other Organizations Exposed via Attribute Search and Paginated View",
"x_gcve": [
{
"extensions": {
"bcp-05-x-01": {
"ai_annotations": [
{
"ai_level": "generated",
"description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
"gna_source": 1,
"models": [
{
"gna_source": 1,
"identifier": "qwen3.8:27b",
"name": "qwen3.8:27b",
"source": "ollama"
}
],
"review_status": "full",
"scope": "record",
"tags": [
"ai-computer-assisted:llm-generated",
"ai-computer-assisted:classification"
]
}
]
},
"bcp-05-x-02": {
"x_patch2vuln": {
"assumptions": [
"The exact fixed version is not specified in the patch metadata; the fix commit is 37 commits after the v2.5.48 tag, so the fixed release is post-2.5.48 but the exact version number is unknown.",
"PR:L assumes the attacker needs at least read access to an event owned by another organization; if MISP deployments restrict cross-org event visibility more tightly, the effective privilege requirement may be higher.",
"CAPEC-126 is the closest available mapping but is not a perfect fit; the vulnerability is an information disclosure via missing authorization rather than data alteration.",
"VC:L assumes the exposure is limited to soft-deleted attributes (a subset of event data) and does not include active attributes or full event metadata.",
"The patch does not specify whether this affects all MISP deployments or only multi-organization configurations; the CVSS assumes a multi-org deployment where cross-org visibility is possible."
],
"capecRationale": [
{
"capecId": "CAPEC-126",
"rationale": "This CAPEC describes leveraging legitimate application code paths to access or manipulate data beyond intended permissions. The attacker uses the legitimate attribute search and paginated view endpoints (executable code paths) to retrieve soft-deleted attributes from other organizations. The mapping is imperfect because CAPEC-126 emphasizes data alteration, whereas this vulnerability is purely an information disclosure. However, among available CAPEC patterns, this is the closest match for exploiting a legitimate code path to bypass intended access restrictions. No CAPEC specifically covers \u0027information disclosure via missing authorization in a query endpoint\u0027 with greater precision."
}
],
"commit": "bd81c23cf2aced3c72766369dc813612edd52509",
"confidence": "medium",
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5.5 (1M context)"
},
{
"lang": "en",
"type": "reporter",
"value": "elhoim"
}
],
"cvssRationale": "AV:N: The vulnerability is exploitable over the network via the MISP web API. AC:L: Exploitation requires only a standard query with the deleted-attribute filter; no race conditions or complex setup. AT:N: No special attack requirements. PR:L: An authenticated user with at least read access to an event owned by another organization is required. UI:N: No victim interaction needed; the data is returned in the API response. VC:L: Confidentiality impact is limited to soft-deleted attributes (a subset of event data) from other organizations; not all data is exposed. VI:N, VA:N: No integrity or availability impact on the vulnerable component. SC:N, SI:N, SA:N: No impact on subsequent components.",
"fixSummary": "The fix enforces organizational ownership checks on soft-deleted attribute queries. When a user without sync permission requests deleted attributes, the query is now constrained to only return soft-deleted attributes whose parent event belongs to the requesting user\u0027s organization. This aligns the attribute search and paginated view behavior with the existing event view authorization logic.",
"generatedAt": "2026-10-02T16:06:38.209479Z",
"generator": "patch2vuln.py",
"model": "qwen3.8:27b",
"modelComparison": {
"rankings": [
{
"agreementScore": 11,
"assumptionCount": 5,
"confidence": "medium",
"model": "qwen3.8:27b",
"score": 7
}
],
"selectedModel": "qwen3.8:27b",
"selectionMethod": "deterministic-consensus-v1",
"selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
},
"patchSha256": "9673ee1d4db26b032b6e3a2632315d5353cd2718c9b809a5296d28a0002a3722",
"patchSummary": "Two code paths were modified:1. Event.php (fetchPaginatedAttributes): When the deleted filter is active and the user lacks perm_sync, an additional subquery condition is appended requiring the event owner\u0027s org_id to match the user\u0027s org_id. The original blanket deleted=0 or deleted=1 condition is replaced with an OR/AND structure that permits non-deleted attributes for all users but restricts deleted attributes to the owning org.2. MispAttribute.php (fetchAttributes): In the deleted=\u0027only\u0027 branch, when the user lacks perm_sync, an additional AND condition Event.org_id = user.org_id is added to the query conditions, scoping results to the user\u0027s own organization.",
"patchTruncated": false,
"patches": [
{
"commit": "bd81c23cf2aced3c72766369dc813612edd52509",
"date": "Thu, 24 Sep 2026 13:57:21 +0200",
"patchSha256": "9673ee1d4db26b032b6e3a2632315d5353cd2718c9b809a5296d28a0002a3722",
"source": "https://github.com/MISP/MISP/commit/bd81c23cf.patch",
"sourceUrl": "https://github.com/MISP/MISP/commit/bd81c23cf.patch",
"subject": "fix: [security] Show soft-deleted attributes only to the"
}
],
"source": "https://github.com/MISP/MISP/commit/bd81c23cf.patch",
"ssvc": {
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "Supplier",
"timestamp": "2026-10-02T16:06:38Z",
"version": "2.0.3"
},
"subject": "fix: [security] Show soft-deleted attributes only to the",
"tagVersionBoundary": {
"commits_after_fix": 37,
"repository": "https://github.com/MISP/MISP",
"tag": "v2.5.48",
"version": "2.5.48",
"version_type": "semver"
},
"weaknessRationale": [
{
"cweId": "CWE-862",
"rationale": "The attribute search and paginated view code paths were missing the authorization check that restricts soft-deleted attribute visibility to the owning organization. The event view had this check, but the attribute-level query paths did not, allowing any user with event visibility to retrieve soft-deleted attributes from other organizations."
},
{
"cweId": "CWE-284",
"rationale": "More broadly, the application failed to enforce proper access control boundaries between organizations when serving soft-deleted attribute data through specific query endpoints, resulting in cross-organizational information disclosure."
}
]
}
},
"bcp-05-x-03": {
"x_timeline": {
"events": [
{
"description": "Corrective change authored (bd81c23cf2aced3c72766369dc813612edd52509): fix: [security] Show soft-deleted attributes only to the",
"id": "evt-fix-developed-1",
"references": [
"https://github.com/MISP/MISP/commit/bd81c23cf.patch"
],
"timestamp": "2026-09-24T11:57:21Z",
"type": "fix-developed"
}
]
}
}
},
"recordType": "advisory",
"vulnId": "GCVE-1-2026-20248"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "00000000-0000-4000-9000-000000000000",
"cveId": "CVE-2026-104914",
"datePublished": "2026-10-02T16:09:31.553352Z",
"dateReserved": "2026-10-02T16:09:36.435Z",
"dateUpdated": "2026-10-02T16:09:38.126317Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1-2026-20248"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-20203 (GCVE-0-2026-20203)
Vulnerability from cvelistv5 – Published: 2026-04-15 15:17 – Updated: 2026-04-15 17:40
VLAI
EPSS
VEX
Title
Improper Access Control in Data Model Acceleration in Splunk Enterprise
Summary
In Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.10, and 9.3.11, and Splunk Cloud Platform versions below 10.4.2603.0, 10.3.2512.6, 10.2.2510.10, 10.1.2507.19, 10.0.2503.13, and 9.3.2411.127, a low-privileged user that does not hold the `admin` or `power` Splunk roles, has write permission on the app, and does not hold the high-privilege capability `accelerate_datamodel`, could turn on or off Data Model Acceleration due to improper access control.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-15 17:40 UTC
CWE
- CWE-284 - The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Splunk | Splunk Enterprise |
Affected:
10.2 , < 10.2.2
(custom)
Affected: 10.0 , < 10.0.5 (custom) Affected: 9.4 , < 9.4.10 (custom) Affected: 9.3 , < 9.3.11 (custom) |
|
| Splunk | Splunk Cloud Platform |
Affected:
10.4.2603 , < Not Affected
(custom)
Affected: 10.3.2512 , < 10.3.2512.6 (custom) Affected: 10.2.2510 , < 10.2.2510.10 (custom) Affected: 10.1.2507 , < 10.1.2507.19 (custom) Affected: 10.0.2503 , < 10.0.2503.13 (custom) Affected: 9.3.2411 , < 9.3.2411.127 (custom) |
Date Public
2026-04-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-20203",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-15T17:40:22.461732Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-15T17:40:36.484Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Splunk Enterprise",
"vendor": "Splunk",
"versions": [
{
"lessThan": "10.2.2",
"status": "affected",
"version": "10.2",
"versionType": "custom"
},
{
"lessThan": "10.0.5",
"status": "affected",
"version": "10.0",
"versionType": "custom"
},
{
"lessThan": "9.4.10",
"status": "affected",
"version": "9.4",
"versionType": "custom"
},
{
"lessThan": "9.3.11",
"status": "affected",
"version": "9.3",
"versionType": "custom"
}
]
},
{
"product": "Splunk Cloud Platform",
"vendor": "Splunk",
"versions": [
{
"lessThan": "Not Affected",
"status": "affected",
"version": "10.4.2603",
"versionType": "custom"
},
{
"lessThan": "10.3.2512.6",
"status": "affected",
"version": "10.3.2512",
"versionType": "custom"
},
{
"lessThan": "10.2.2510.10",
"status": "affected",
"version": "10.2.2510",
"versionType": "custom"
},
{
"lessThan": "10.1.2507.19",
"status": "affected",
"version": "10.1.2507",
"versionType": "custom"
},
{
"lessThan": "10.0.2503.13",
"status": "affected",
"version": "10.0.2503",
"versionType": "custom"
},
{
"lessThan": "9.3.2411.127",
"status": "affected",
"version": "9.3.2411",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mr Hack (try_to_hack) Santiago Lopez"
}
],
"datePublic": "2026-04-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "In Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.10, and 9.3.11, and Splunk Cloud Platform versions below 10.4.2603.0, 10.3.2512.6, 10.2.2510.10, 10.1.2507.19, 10.0.2503.13, and 9.3.2411.127, a low-privileged user that does not hold the `admin` or `power` Splunk roles,\u00a0has write permission on the app, and does not hold the high-privilege capability `accelerate_datamodel`, could turn on or off Data Model Acceleration due to improper access control."
}
],
"value": "In Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.10, and 9.3.11, and Splunk Cloud Platform versions below 10.4.2603.0, 10.3.2512.6, 10.2.2510.10, 10.1.2507.19, 10.0.2503.13, and 9.3.2411.127, a low-privileged user that does not hold the `admin` or `power` Splunk roles,\u00a0has write permission on the app, and does not hold the high-privilege capability `accelerate_datamodel`, could turn on or off Data Model Acceleration due to improper access control."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-15T15:17:56.261Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"url": "https://advisory.splunk.com/advisories/SVD-2026-0402"
}
],
"source": {
"advisory": "SVD-2026-0402"
},
"title": "Improper Access Control in Data Model Acceleration in Splunk Enterprise"
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2026-20203",
"datePublished": "2026-04-15T15:17:56.261Z",
"dateReserved": "2025-10-08T11:59:15.397Z",
"dateUpdated": "2026-04-15T17:40:36.484Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-20192 (GCVE-0-2026-20192)
Vulnerability from cvelistv5 – Published: 2026-09-16 20:07 – Updated: 2026-09-18 13:41
VLAI
EPSS
VEX
Title
Cisco Identity Services Engine Hardening Release - Access Control Vulnerabilities
Summary
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) engineering teams have conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-20192 are related to improper access control issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-284.
Severity
10 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 03:55 UTC
CWE
- CWE-284 - Improper Access Control
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cisco | Cisco Identity Services Engine Software |
Affected:
3.1.0
Affected: 3.1.0 p1 Affected: 3.1.0 p3 Affected: 3.1.0 p2 Affected: 3.2.0 Affected: 3.1.0 p4 Affected: 3.1.0 p5 Affected: 3.2.0 p1 Affected: 3.1.0 p6 Affected: 3.2.0 p2 Affected: 3.1.0 p7 Affected: 3.3.0 Affected: 3.2.0 p3 Affected: 3.2.0 p4 Affected: 3.1.0 p8 Affected: 3.2.0 p5 Affected: 3.2.0 p6 Affected: 3.1.0 p9 Affected: 3.3 Patch 2 Affected: 3.3 Patch 1 Affected: 3.3 Patch 3 Affected: 3.4.0 Affected: 3.2.0 p7 Affected: 3.3 Patch 4 Affected: 3.4 Patch 1 Affected: 3.1.0 p10 Affected: 3.3 Patch 5 Affected: 3.3 Patch 6 Affected: 3.4 Patch 2 Affected: 3.3 Patch 7 Affected: 3.4 Patch 3 Affected: 3.5.0 Affected: 3.4 Patch 4 Affected: 3.3 Patch 8 Affected: 3.2 Patch 8 Affected: 3.5 Patch 1 Affected: 3.3 Patch 9 Affected: 3.2 Patch 9 Affected: 3.4 Patch 5 Affected: 3.5 Patch 3 Affected: 3.5 Patch 2 Affected: 3.3 Patch 10 Affected: 3.3 Patch 11 Affected: 3.4 Patch 6 Affected: 3.2 Patch 10 Affected: 3.1.0 p72 Affected: 3.1.0 p11 |
|
| Cisco | Cisco ISE Passive Identity Connector |
Affected:
3.2.0
Affected: 3.1.0 Affected: 3.3.0 Affected: 3.4.0 Affected: 3.5.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-20192",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T03:55:53.856937Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T13:41:16.609Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Cisco Identity Services Engine Software",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "3.1.0"
},
{
"status": "affected",
"version": "3.1.0 p1"
},
{
"status": "affected",
"version": "3.1.0 p3"
},
{
"status": "affected",
"version": "3.1.0 p2"
},
{
"status": "affected",
"version": "3.2.0"
},
{
"status": "affected",
"version": "3.1.0 p4"
},
{
"status": "affected",
"version": "3.1.0 p5"
},
{
"status": "affected",
"version": "3.2.0 p1"
},
{
"status": "affected",
"version": "3.1.0 p6"
},
{
"status": "affected",
"version": "3.2.0 p2"
},
{
"status": "affected",
"version": "3.1.0 p7"
},
{
"status": "affected",
"version": "3.3.0"
},
{
"status": "affected",
"version": "3.2.0 p3"
},
{
"status": "affected",
"version": "3.2.0 p4"
},
{
"status": "affected",
"version": "3.1.0 p8"
},
{
"status": "affected",
"version": "3.2.0 p5"
},
{
"status": "affected",
"version": "3.2.0 p6"
},
{
"status": "affected",
"version": "3.1.0 p9"
},
{
"status": "affected",
"version": "3.3 Patch 2"
},
{
"status": "affected",
"version": "3.3 Patch 1"
},
{
"status": "affected",
"version": "3.3 Patch 3"
},
{
"status": "affected",
"version": "3.4.0"
},
{
"status": "affected",
"version": "3.2.0 p7"
},
{
"status": "affected",
"version": "3.3 Patch 4"
},
{
"status": "affected",
"version": "3.4 Patch 1"
},
{
"status": "affected",
"version": "3.1.0 p10"
},
{
"status": "affected",
"version": "3.3 Patch 5"
},
{
"status": "affected",
"version": "3.3 Patch 6"
},
{
"status": "affected",
"version": "3.4 Patch 2"
},
{
"status": "affected",
"version": "3.3 Patch 7"
},
{
"status": "affected",
"version": "3.4 Patch 3"
},
{
"status": "affected",
"version": "3.5.0"
},
{
"status": "affected",
"version": "3.4 Patch 4"
},
{
"status": "affected",
"version": "3.3 Patch 8"
},
{
"status": "affected",
"version": "3.2 Patch 8"
},
{
"status": "affected",
"version": "3.5 Patch 1"
},
{
"status": "affected",
"version": "3.3 Patch 9"
},
{
"status": "affected",
"version": "3.2 Patch 9"
},
{
"status": "affected",
"version": "3.4 Patch 5"
},
{
"status": "affected",
"version": "3.5 Patch 3"
},
{
"status": "affected",
"version": "3.5 Patch 2"
},
{
"status": "affected",
"version": "3.3 Patch 10"
},
{
"status": "affected",
"version": "3.3 Patch 11"
},
{
"status": "affected",
"version": "3.4 Patch 6"
},
{
"status": "affected",
"version": "3.2 Patch 10"
},
{
"status": "affected",
"version": "3.1.0 p72"
},
{
"status": "affected",
"version": "3.1.0 p11"
}
]
},
{
"defaultStatus": "unknown",
"product": "Cisco ISE Passive Identity Connector",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "3.2.0"
},
{
"status": "affected",
"version": "3.1.0"
},
{
"status": "affected",
"version": "3.3.0"
},
{
"status": "affected",
"version": "3.4.0"
},
{
"status": "affected",
"version": "3.5.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "As part of Cisco\u0027s ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) engineering teams have conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities tracked by CVE-2026-20192 are related to improper access control issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-284."
}
],
"exploits": [
{
"lang": "en",
"value": "Except as otherwise noted previously, the Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Control",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T20:07:00.603Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-hardening-ise-XU5EwX5T",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-ise-XU5EwX5T"
}
],
"source": {
"advisory": "cisco-sa-hardening-ise-XU5EwX5T",
"defects": [
"CSCwu26097"
],
"discovery": "INTERNAL"
},
"title": "Cisco Identity Services Engine Hardening Release - Access Control Vulnerabilities"
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2026-20192",
"datePublished": "2026-09-16T20:07:00.603Z",
"dateReserved": "2025-10-08T11:59:15.395Z",
"dateUpdated": "2026-09-18T13:41:16.609Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-20167 (GCVE-0-2026-20167)
Vulnerability from cvelistv5 – Published: 2026-05-06 16:15 – Updated: 2026-05-06 17:26
VLAI
EPSS
VEX
Title
Cisco IoT Field Network Director Remote Device Denial of Service Vulnerability
Summary
A vulnerability in the web-based management interface of Cisco IoT Field Network Director could allow an authenticated, remote attacker with low privileges to cause a DoS condition on a remotely managed router.
This vulnerability is due to improper error handling. An attacker could exploit this vulnerability by submitting crafted input to the web-based management interface. A successful exploit could allow the attacker to request unauthorized files from a remote router, causing the router to reload and resulting in a DoS condition.
Severity
7.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-06 17:25 UTC
CWE
- CWE-284 - Improper Access Control
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Cisco | Cisco IoT Field Network Director (IoT-FND) |
Affected:
4.5.1
Affected: 4.4.3 Affected: 4.1.0 Affected: 4.1.3 Affected: 4.6.1 Affected: 4.1.1 Affected: 4.4.0 Affected: 4.2.0 Affected: 4.4.2 Affected: 4.3.0 Affected: 4.6.0 Affected: 4.4.4 Affected: 4.3.2 Affected: 4.1.2 Affected: 4.4.1 Affected: 4.5.0 Affected: 4.3.1 Affected: 4.7.0 Affected: 4.6.2 Affected: 4.7.1 Affected: 4.7.2 Affected: 4.8.0 Affected: 4.8.1 Affected: 4.9.0 Affected: 4.9.1 Affected: 4.10.0 Affected: 4.9.2 Affected: 4.11.0 Affected: 4.12.0 Affected: 4.12.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-20167",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-06T17:25:48.384518Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-06T17:26:01.173Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Cisco IoT Field Network Director (IoT-FND)",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "4.5.1"
},
{
"status": "affected",
"version": "4.4.3"
},
{
"status": "affected",
"version": "4.1.0"
},
{
"status": "affected",
"version": "4.1.3"
},
{
"status": "affected",
"version": "4.6.1"
},
{
"status": "affected",
"version": "4.1.1"
},
{
"status": "affected",
"version": "4.4.0"
},
{
"status": "affected",
"version": "4.2.0"
},
{
"status": "affected",
"version": "4.4.2"
},
{
"status": "affected",
"version": "4.3.0"
},
{
"status": "affected",
"version": "4.6.0"
},
{
"status": "affected",
"version": "4.4.4"
},
{
"status": "affected",
"version": "4.3.2"
},
{
"status": "affected",
"version": "4.1.2"
},
{
"status": "affected",
"version": "4.4.1"
},
{
"status": "affected",
"version": "4.5.0"
},
{
"status": "affected",
"version": "4.3.1"
},
{
"status": "affected",
"version": "4.7.0"
},
{
"status": "affected",
"version": "4.6.2"
},
{
"status": "affected",
"version": "4.7.1"
},
{
"status": "affected",
"version": "4.7.2"
},
{
"status": "affected",
"version": "4.8.0"
},
{
"status": "affected",
"version": "4.8.1"
},
{
"status": "affected",
"version": "4.9.0"
},
{
"status": "affected",
"version": "4.9.1"
},
{
"status": "affected",
"version": "4.10.0"
},
{
"status": "affected",
"version": "4.9.2"
},
{
"status": "affected",
"version": "4.11.0"
},
{
"status": "affected",
"version": "4.12.0"
},
{
"status": "affected",
"version": "4.12.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the web-based management interface of Cisco IoT Field Network Director could allow an authenticated, remote attacker with low privileges to cause a DoS condition on a remotely managed router.\r\n\r\nThis vulnerability is due to improper error handling. An attacker could exploit this vulnerability by submitting crafted input to the web-based management interface. A successful exploit could allow the attacker to request unauthorized files from a remote router, causing the router to reload and resulting in a DoS condition."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Control",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-06T16:15:57.113Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-iot-fnd-dos-n8N26Q4u",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iot-fnd-dos-n8N26Q4u"
}
],
"source": {
"advisory": "cisco-sa-iot-fnd-dos-n8N26Q4u",
"defects": [
"CSCwm81015"
],
"discovery": "EXTERNAL"
},
"title": "Cisco IoT Field Network Director Remote Device Denial of Service Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2026-20167",
"datePublished": "2026-05-06T16:15:57.113Z",
"dateReserved": "2025-10-08T11:59:15.390Z",
"dateUpdated": "2026-05-06T17:26:01.173Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-20150 (GCVE-0-2026-20150)
Vulnerability from cvelistv5 – Published: 2026-07-15 16:17 – Updated: 2026-08-14 20:57
VLAI
EPSS
VEX
CVE Program bundle warning
The CVE Program recognizes that this CVE Record provides vulnerability information that a Supplier CNA believes is very important to consumers. The CVE Program has flagged this CVE Record as it assigns a single CVE ID to a collection of individual vulnerabilities which does not align with CVE's "one vulnerability, one ID" principle, and therefore provides incomplete information. For further clarification, please see the CVE Program's blog, "Preserving Vulnerability-Level Identification" linked below. Details within the CNA container below are viewable by clicking on the CNA name.
https://www.cve.org/Media/News/item/blog/2026/06/…Title
Cisco RoomOS Security Hardening Release - Access Control Vulnerabilities
Summary
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-20150 are related to improper access control that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-284.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-15 18:46 UTC
CWE
- CWE-284 - Improper Access Control
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Cisco | Cisco RoomOS Software |
Affected:
RoomOS 10.11.2.2
Affected: RoomOS 10.15.2.2 Affected: RoomOS 11.5.4.6 Affected: RoomOS 11.5.2.4 Affected: RoomOS 10.8.2.5 Affected: RoomOS 10.11.5.2 Affected: RoomOS 10.11.3.0 Affected: RoomOS 10.15.5.3 Affected: RoomOS 10.19.2.2 Affected: RoomOS 11.1.3.1 Affected: RoomOS 10.11.6.0 Affected: RoomOS 10.19.3.0 Affected: RoomOS 10.19.4.2 Affected: RoomOS 10.3.2.4 Affected: RoomOS 10.3.4.0 Affected: RoomOS 10.15.3.0 Affected: RoomOS 11.1.4.1 Affected: RoomOS 11.14.2.3 Affected: RoomOS 11.1.2.4 Affected: RoomOS 10.8.3.1 Affected: RoomOS 11.14.2.1 Affected: RoomOS 10.3.3.0 Affected: RoomOS 10.8.4.0 Affected: RoomOS 10.15.4.1 Affected: RoomOS 10.19.5.6 Affected: RoomOS 10.11.4.1 Affected: RoomOS 11.9.3.1 Affected: RoomOS 11.5.3.3 Affected: RoomOS 10.3.2.0 Affected: RoomOS 11.9.2.4 Affected: RoomOS 11.14.3.0 Affected: RoomOS 11.17.2.2 Affected: RoomOS 11.14.4.0 Affected: RoomOS 10.19 StepUpg Affected: RoomOS 11.17.3.0 Affected: RoomOS 11.20.2.3 Affected: RoomOS 11.14.5.0 Affected: RoomOS 11.17.4.0 Affected: RoomOS 11.20.3.0 Affected: RoomOS 11.23.1.6 Affected: RoomOS 11.23.1.8 Affected: RoomOS 11.24.1.5 Affected: RoomOS 11.24.2.4 Affected: RoomOS 11.24.3.0 Affected: RoomOS 11.24.4.1 Affected: RoomOS 11.27.2.0 Affected: RoomOS 11.28.1.3 Affected: RoomOS 11.27.3.0 Affected: RoomOS 11.31.1.5 Affected: RoomOS 11.27.4.0 Affected: RoomOS 11.32.2.1 Affected: RoomOS 11.33.1.7 Affected: RoomOS 26.0.1.2 Affected: RoomOS 11.34.1.2 Affected: RoomOS 11.32.3.0 Affected: RoomOS 11.27.5.0 Affected: RoomOS 11.32.4.0 Affected: RoomOS 26.1.1.5 Affected: RoomOS 11.35.1.2 Affected: RoomOS 26.2.2.2 Affected: RoomOS 11.32.5.1 Affected: RoomOS 26.4.1.6 Affected: RoomOS 26.4.1.4 Affected: RoomOS 26.3.1.3 Affected: RoomOS 11.36.1.1 Affected: RoomOS 11.37.1.0 Affected: RoomOS 26.5.2.0 Affected: RoomOS 11.38.1.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-20150",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-15T18:46:22.944748Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T18:46:29.743Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"descriptions": [
{
"lang": "en",
"value": "The CVE Program recognizes that this CVE Record provides vulnerability information that a Supplier CNA believes is very important to consumers. The CVE Program has flagged this CVE Record as it assigns a single CVE ID to a collection of individual vulnerabilities which does not align with CVE\u0027s \"one vulnerability, one ID\" principle, and therefore provides incomplete information. For further clarification, please see the CVE Program\u0027s blog, \"Preserving Vulnerability-Level Identification\" linked below. Details within the CNA container below are viewable by clicking on the CNA name."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T20:57:54.323Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://www.cve.org/Media/News/item/blog/2026/06/16/Preserving-Vulnerability-Level-Identification"
}
],
"tags": [
"x_bundling-flagged-by-CVE-Program"
]
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Cisco RoomOS Software",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "RoomOS 10.11.2.2"
},
{
"status": "affected",
"version": "RoomOS 10.15.2.2"
},
{
"status": "affected",
"version": "RoomOS 11.5.4.6"
},
{
"status": "affected",
"version": "RoomOS 11.5.2.4"
},
{
"status": "affected",
"version": "RoomOS 10.8.2.5"
},
{
"status": "affected",
"version": "RoomOS 10.11.5.2"
},
{
"status": "affected",
"version": "RoomOS 10.11.3.0"
},
{
"status": "affected",
"version": "RoomOS 10.15.5.3"
},
{
"status": "affected",
"version": "RoomOS 10.19.2.2"
},
{
"status": "affected",
"version": "RoomOS 11.1.3.1"
},
{
"status": "affected",
"version": "RoomOS 10.11.6.0"
},
{
"status": "affected",
"version": "RoomOS 10.19.3.0"
},
{
"status": "affected",
"version": "RoomOS 10.19.4.2"
},
{
"status": "affected",
"version": "RoomOS 10.3.2.4"
},
{
"status": "affected",
"version": "RoomOS 10.3.4.0"
},
{
"status": "affected",
"version": "RoomOS 10.15.3.0"
},
{
"status": "affected",
"version": "RoomOS 11.1.4.1"
},
{
"status": "affected",
"version": "RoomOS 11.14.2.3"
},
{
"status": "affected",
"version": "RoomOS 11.1.2.4"
},
{
"status": "affected",
"version": "RoomOS 10.8.3.1"
},
{
"status": "affected",
"version": "RoomOS 11.14.2.1"
},
{
"status": "affected",
"version": "RoomOS 10.3.3.0"
},
{
"status": "affected",
"version": "RoomOS 10.8.4.0"
},
{
"status": "affected",
"version": "RoomOS 10.15.4.1"
},
{
"status": "affected",
"version": "RoomOS 10.19.5.6"
},
{
"status": "affected",
"version": "RoomOS 10.11.4.1"
},
{
"status": "affected",
"version": "RoomOS 11.9.3.1"
},
{
"status": "affected",
"version": "RoomOS 11.5.3.3"
},
{
"status": "affected",
"version": "RoomOS 10.3.2.0"
},
{
"status": "affected",
"version": "RoomOS 11.9.2.4"
},
{
"status": "affected",
"version": "RoomOS 11.14.3.0"
},
{
"status": "affected",
"version": "RoomOS 11.17.2.2"
},
{
"status": "affected",
"version": "RoomOS 11.14.4.0"
},
{
"status": "affected",
"version": "RoomOS 10.19 StepUpg"
},
{
"status": "affected",
"version": "RoomOS 11.17.3.0"
},
{
"status": "affected",
"version": "RoomOS 11.20.2.3"
},
{
"status": "affected",
"version": "RoomOS 11.14.5.0"
},
{
"status": "affected",
"version": "RoomOS 11.17.4.0"
},
{
"status": "affected",
"version": "RoomOS 11.20.3.0"
},
{
"status": "affected",
"version": "RoomOS 11.23.1.6"
},
{
"status": "affected",
"version": "RoomOS 11.23.1.8"
},
{
"status": "affected",
"version": "RoomOS 11.24.1.5"
},
{
"status": "affected",
"version": "RoomOS 11.24.2.4"
},
{
"status": "affected",
"version": "RoomOS 11.24.3.0"
},
{
"status": "affected",
"version": "RoomOS 11.24.4.1"
},
{
"status": "affected",
"version": "RoomOS 11.27.2.0"
},
{
"status": "affected",
"version": "RoomOS 11.28.1.3"
},
{
"status": "affected",
"version": "RoomOS 11.27.3.0"
},
{
"status": "affected",
"version": "RoomOS 11.31.1.5"
},
{
"status": "affected",
"version": "RoomOS 11.27.4.0"
},
{
"status": "affected",
"version": "RoomOS 11.32.2.1"
},
{
"status": "affected",
"version": "RoomOS 11.33.1.7"
},
{
"status": "affected",
"version": "RoomOS 26.0.1.2"
},
{
"status": "affected",
"version": "RoomOS 11.34.1.2"
},
{
"status": "affected",
"version": "RoomOS 11.32.3.0"
},
{
"status": "affected",
"version": "RoomOS 11.27.5.0"
},
{
"status": "affected",
"version": "RoomOS 11.32.4.0"
},
{
"status": "affected",
"version": "RoomOS 26.1.1.5"
},
{
"status": "affected",
"version": "RoomOS 11.35.1.2"
},
{
"status": "affected",
"version": "RoomOS 26.2.2.2"
},
{
"status": "affected",
"version": "RoomOS 11.32.5.1"
},
{
"status": "affected",
"version": "RoomOS 26.4.1.6"
},
{
"status": "affected",
"version": "RoomOS 26.4.1.4"
},
{
"status": "affected",
"version": "RoomOS 26.3.1.3"
},
{
"status": "affected",
"version": "RoomOS 11.36.1.1"
},
{
"status": "affected",
"version": "RoomOS 11.37.1.0"
},
{
"status": "affected",
"version": "RoomOS 26.5.2.0"
},
{
"status": "affected",
"version": "RoomOS 11.38.1.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "As part of Cisco\u0027s ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities tracked by CVE-2026-20150 are related to improper access control\u0026nbsp;that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-284."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Control",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T16:17:00.370Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-hardening-roomos-AqNMbEq",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-roomos-AqNMbEq"
}
],
"source": {
"advisory": "cisco-sa-hardening-roomos-AqNMbEq",
"defects": [
"CSCwu54714"
],
"discovery": "INTERNAL"
},
"title": "Cisco RoomOS Security Hardening Release - Access Control Vulnerabilities"
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2026-20150",
"datePublished": "2026-07-15T16:17:00.370Z",
"dateReserved": "2025-10-08T11:59:15.385Z",
"dateUpdated": "2026-08-14T20:57:54.323Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-20121 (GCVE-0-2026-20121)
Vulnerability from cvelistv5 – Published: 2026-09-16 20:24 – Updated: 2026-09-18 19:08
VLAI
EPSS
VEX
Title
CIsco FTD Bypass Access List
Summary
A vulnerability in the access control list (ACL) Object Group Search (OGS) implementation of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass configured access controls.
This vulnerability is due to a logic error in populating group access control policies (ACPs) with OGS configured. An attacker could exploit this vulnerability by sending traffic that should be blocked through the device. A successful exploit could allow the attacker to bypass access controls and reach devices in protected networks.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 15:56 UTC
CWE
- CWE-284 - Improper Access Control
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cisco | Cisco Secure Firewall Adaptive Security Appliance (ASA) Software |
Affected:
9.23.1
Affected: 9.22.1.1 Affected: 9.22.1.3 Affected: 9.22.1.2 Affected: 9.22.1.6 Affected: 9.22.2 Affected: 9.23.1.3 Affected: 9.22.2.4 Affected: 9.23.1.7 Affected: 9.22.2.9 Affected: 9.23.1.13 Affected: 9.22.2.13 Affected: 9.23.1.19 Affected: 9.22.2.14 Affected: 9.23.1.22 Affected: 9.22.2.20 |
|
| Cisco | Cisco Secure Firewall Threat Defense (FTD) Software |
Affected:
7.6.0
Affected: 7.7.0 Affected: 7.6.1 Affected: 7.6.2 Affected: 7.7.10 Affected: 7.7.11 Affected: 7.6.2.1 Affected: 7.7.10.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-20121",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T15:56:35.178454Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T15:56:48.183Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Cisco Secure Firewall Adaptive Security Appliance (ASA) Software",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "9.23.1"
},
{
"status": "affected",
"version": "9.22.1.1"
},
{
"status": "affected",
"version": "9.22.1.3"
},
{
"status": "affected",
"version": "9.22.1.2"
},
{
"status": "affected",
"version": "9.22.1.6"
},
{
"status": "affected",
"version": "9.22.2"
},
{
"status": "affected",
"version": "9.23.1.3"
},
{
"status": "affected",
"version": "9.22.2.4"
},
{
"status": "affected",
"version": "9.23.1.7"
},
{
"status": "affected",
"version": "9.22.2.9"
},
{
"status": "affected",
"version": "9.23.1.13"
},
{
"status": "affected",
"version": "9.22.2.13"
},
{
"status": "affected",
"version": "9.23.1.19"
},
{
"status": "affected",
"version": "9.22.2.14"
},
{
"status": "affected",
"version": "9.23.1.22"
},
{
"status": "affected",
"version": "9.22.2.20"
}
]
},
{
"defaultStatus": "unknown",
"product": "Cisco Secure Firewall Threat Defense (FTD) Software",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "7.6.0"
},
{
"status": "affected",
"version": "7.7.0"
},
{
"status": "affected",
"version": "7.6.1"
},
{
"status": "affected",
"version": "7.6.2"
},
{
"status": "affected",
"version": "7.7.10"
},
{
"status": "affected",
"version": "7.7.11"
},
{
"status": "affected",
"version": "7.6.2.1"
},
{
"status": "affected",
"version": "7.7.10.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the access control list (ACL) Object Group Search (OGS) implementation of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass configured access controls.\r\n\r\nThis vulnerability is due to a logic error in populating group access control policies (ACPs) with OGS configured. An attacker could exploit this vulnerability by sending traffic that should be blocked through the device. A successful exploit could allow the attacker to bypass access controls and reach devices in protected networks."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Control",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T19:08:46.060Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-ftd-acl-bypass-8p6vFvw",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-acl-bypass-8p6vFvw"
}
],
"source": {
"advisory": "cisco-sa-ftd-acl-bypass-8p6vFvw",
"defects": [
"CSCwr49050"
],
"discovery": "EXTERNAL"
},
"title": "CIsco FTD Bypass Access List"
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2026-20121",
"datePublished": "2026-09-16T20:24:54.360Z",
"dateReserved": "2025-10-08T11:59:15.377Z",
"dateUpdated": "2026-09-18T19:08:46.060Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-20120 (GCVE-0-2026-20120)
Vulnerability from cvelistv5 – Published: 2026-09-16 20:19 – Updated: 2026-09-18 19:08
VLAI
EPSS
VEX
Title
Cisco FTD ACL bypass vulnerability
Summary
A vulnerability in the access control list (ACL) Object Group Search (OGS) implementation of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass configured access controls.
This vulnerability is due to a logic error in populating group access control policies (ACPs) with OGS configured. An attacker could exploit this vulnerability by sending traffic that should be blocked through the device. A successful exploit could allow the attacker to bypass access controls and reach devices in protected networks.
Severity
5.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 16:03 UTC
CWE
- CWE-284 - Improper Access Control
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cisco | Cisco Secure Firewall Adaptive Security Appliance (ASA) Software |
Affected:
9.23.1
Affected: 9.22.1.1 Affected: 9.22.1.3 Affected: 9.22.1.2 Affected: 9.22.1.6 Affected: 9.22.2 Affected: 9.23.1.3 Affected: 9.22.2.4 Affected: 9.23.1.7 Affected: 9.22.2.9 Affected: 9.23.1.13 Affected: 9.22.2.13 Affected: 9.23.1.19 Affected: 9.22.2.14 Affected: 9.23.1.22 Affected: 9.22.2.20 |
|
| Cisco | Cisco Secure Firewall Threat Defense (FTD) Software |
Affected:
7.6.0
Affected: 7.7.0 Affected: 7.6.1 Affected: 7.6.2 Affected: 7.7.10 Affected: 7.7.11 Affected: 7.6.2.1 Affected: 7.7.10.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-20120",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T16:03:41.816941Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T16:03:51.646Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Cisco Secure Firewall Adaptive Security Appliance (ASA) Software",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "9.23.1"
},
{
"status": "affected",
"version": "9.22.1.1"
},
{
"status": "affected",
"version": "9.22.1.3"
},
{
"status": "affected",
"version": "9.22.1.2"
},
{
"status": "affected",
"version": "9.22.1.6"
},
{
"status": "affected",
"version": "9.22.2"
},
{
"status": "affected",
"version": "9.23.1.3"
},
{
"status": "affected",
"version": "9.22.2.4"
},
{
"status": "affected",
"version": "9.23.1.7"
},
{
"status": "affected",
"version": "9.22.2.9"
},
{
"status": "affected",
"version": "9.23.1.13"
},
{
"status": "affected",
"version": "9.22.2.13"
},
{
"status": "affected",
"version": "9.23.1.19"
},
{
"status": "affected",
"version": "9.22.2.14"
},
{
"status": "affected",
"version": "9.23.1.22"
},
{
"status": "affected",
"version": "9.22.2.20"
}
]
},
{
"defaultStatus": "unknown",
"product": "Cisco Secure Firewall Threat Defense (FTD) Software",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "7.6.0"
},
{
"status": "affected",
"version": "7.7.0"
},
{
"status": "affected",
"version": "7.6.1"
},
{
"status": "affected",
"version": "7.6.2"
},
{
"status": "affected",
"version": "7.7.10"
},
{
"status": "affected",
"version": "7.7.11"
},
{
"status": "affected",
"version": "7.6.2.1"
},
{
"status": "affected",
"version": "7.7.10.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the access control list (ACL) Object Group Search (OGS) implementation of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass configured access controls.\r\n\r\nThis vulnerability is due to a logic error in populating group access control policies (ACPs) with OGS configured. An attacker could exploit this vulnerability by sending traffic that should be blocked through the device. A successful exploit could allow the attacker to bypass access controls and reach devices in protected networks."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Control",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T19:08:46.057Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-ftd-acl-bypass-8p6vFvw",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-acl-bypass-8p6vFvw"
}
],
"source": {
"advisory": "cisco-sa-ftd-acl-bypass-8p6vFvw",
"defects": [
"CSCwr04957"
],
"discovery": "INTERNAL"
},
"title": "Cisco FTD ACL bypass vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2026-20120",
"datePublished": "2026-09-16T20:19:12.537Z",
"dateReserved": "2025-10-08T11:59:15.377Z",
"dateUpdated": "2026-09-18T19:08:46.057Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1-2026-20117 (CVE-2026-106513)
Vulnerability from gna-1 – Published: 2026-10-06 18:58 – Updated: 2026-10-06 19:03
VLAI
EPSS
VEX
Title
MISP: Site-Admin Can Repoint Redis Workers to Attacker-Controlled Server via UI/API Configuration Change
Summary
MISP exposes critical infrastructure settings—specifically the Redis host addresses used by the core application, the ZeroMQ plugin, and the SimpleBackgroundJobs plugin—through its web UI and API to site-admin users. The background job workers trust raw Redis job payloads without additional validation. An attacker who obtains a hijacked site-admin session (for example, through a stored cross-site scripting vulnerability) can modify the Redis host settings to point at an attacker-controlled Redis server and then restart the workers. Once the workers connect to the attacker's Redis instance, the attacker can inject malicious job payloads that the workers execute, achieving arbitrary command execution as the worker account. Additionally, the download_attachments_on_load setting, which controls inline attachment rendering, was modifiable through the same interface, allowing a hijacked session to re-enable a feature that could facilitate further client-side attacks. The vulnerability requires site-admin privileges and a prior session-compromise mechanism; it does not require unauthenticated access. The impact is remote code execution in the context of the MISP worker process and potential data exfiltration through the attacker-controlled Redis connection.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
Supplier · CNA (v2.0.3)
Decision recorded 2026-10-06 18:56 UTC
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/MISP/MISP/commit/2ebf29f93 | patch |
Impacted products
GCVE extensions
AI-generated
Partially reviewed
Confidence: medium
Model
qwen3.8:27b
1 event
advisory
bcp-05-x-01bcp-05-x-02bcp-05-x-03
Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.
ai-computer-assisted:llm-generatedai-computer-assisted:classification
| Model | Source | Identifier |
|---|---|---|
| qwen3.8:27b | ollama | qwen3.8:27b |
- Generator
-
patch2vuln.pyon 2026-10-06 18:56 - Model
qwen3.8:27b- Input
-
https://github.com/MISP/MISP/commit/2ebf29f93.patch
8262490f9bcc… - Confidence
- medium
| Commit | Subject | Patch SHA-256 |
|---|---|---|
2ebf29f93dd8
|
fix: [security] Make redis host and attachment download | 8262490f9bcc… |
Fix summary
The fix restricts the Redis host settings (MISP.redis_host, Plugin.ZeroMQ_redis_host, SimpleBackgroundJobs.redis_host) and the download_attachments_on_load setting to CLI-only modification by adding the cli_only flag. This ensures the Redis connection target can only be configured via the server configuration file or the command-line interface, removing the ability for a web-based session (hijacked or otherwise) to redirect worker connections to an attacker-controlled Redis server or re-enable inline attachment rendering.
Patch summary
In app/Model/Server.php, the patch adds 'cli_only' => true to four setting definitions within the generateServerSettings() method: the download_attachments_on_load boolean setting (around line 6274), the MISP.redis_host string setting (around line 7037), the Plugin.ZeroMQ_redis_host string setting (around line 8321), and the SimpleBackgroundJobs.redis_host string setting (around line 9050). Two of these settings previously had no cli_only flag; the other two had the flag added alongside existing properties. The change totals 6 insertions and 2 deletions across the single file.
CVSS rationale
AV:N: The settings are modified via the web UI or API over the network. AC:H: Exploitation requires a prior session-compromise mechanism (e.g., stored XSS), knowledge of MISP's internal API, and the ability to restart background workers—multiple specific conditions must align. AT:N: No additional attack complexity beyond what AC captures. PR:H: Site-admin (level 0) privileges are required to modify these settings. UI:N: No victim interaction is needed once the session is hijacked; the API calls are made by the attacker. VC:N: No direct confidentiality impact on MISP itself. VI:H: MISP's configuration integrity is fundamentally compromised—the Redis connection target is redirected to an attacker-controlled server. VA:N: No direct availability impact on MISP. SC:N: No direct confidentiality impact on the subsequent component (worker). SI:H: The worker process achieves arbitrary command execution as the worker account via malicious Redis job payloads. SA:N: No availability impact on the subsequent component.
Weakness rationale
- CWE-284 The Redis host and attachment rendering settings were accessible for modification via the web UI/API by site-admin users, when they should have been restricted to CLI or server configuration only. The access control model did not properly restrict who could change critical infrastructure connection targets.
- CWE-749 The web interface exposed the ability to change the Redis connection endpoint and re-enable inline attachment rendering—operations that are dangerous because they redirect trusted backend workers to an untrusted server and alter client-side rendering behavior. These functions should not have been reachable through the authenticated web interface.
Attack pattern rationale
- CAPEC-126 The commit message explicitly identifies a 'hijacked site-admin session' as the prerequisite attack vector, and the exploitation path relies on an authenticated session making API/UI calls to modify configuration. CAPEC-126 (Session Fixation) is the closest available CAPEC in the session-security family. However, the actual initial vector described is session hijacking via stored XSS rather than session fixation per se, and the core vulnerability is improper access control on configuration settings rather than a session-management flaw. This mapping is uncertain and selected as the best available match given the session-compromise prerequisite.
- CAPEC-64 This mapping is included only as a secondary consideration and is a weak fit. The attack does not involve CRLF injection or HTTP splitting. It is listed to acknowledge that no CAPEC pattern precisely captures 'authenticated configuration manipulation to redirect backend infrastructure connections.' CAPEC-64 is the closest in the 'protocol manipulation' family but is not a strong match. This mapping is highly uncertain.
Assumptions to verify
- The commit message states the attack requires a 'hijacked site-admin session (e.g. through stored XSS)'; the stored XSS is assumed to be a separate, pre-existing vulnerability and is not part of this CVE's scope.
- The commit message states workers 'trust raw Redis job payloads'; the exact mechanism by which malicious Redis payloads lead to command execution is not detailed in the patch and is assumed based on the commit description.
- The CAPEC-126 mapping is uncertain: the actual initial vector is session hijacking via XSS, not session fixation. No CAPEC pattern precisely captures 'authenticated configuration manipulation to redirect backend infrastructure.' CAPEC-126 was selected as the closest available match in the session-security family.
- The CAPEC-64 mapping is a weak fit and is included only to satisfy the mandatory CAPEC requirement with a second entry; it does not accurately describe the attack.
- Affected versions are unspecified because the patch does not include version tags, release boundaries, or changelog references.
- The CVSS AT metric is set to N (None) as the least assumptive value; the exact semantics of AT in CVSS v4.0 relative to AC are not fully clarified in the available evidence.
- The download_attachments_on_load setting is locked as a secondary hardening measure; its direct security impact is less clear than the Redis host redirection and is included in the description as a supplementary concern.
- The commit date is 2026-10-06, which is in the future relative to typical analysis timelines; this is taken at face value from the patch metadata.
Model comparison
Selected qwen3.8:27b
by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.
| Model | Score | Agreement | Confidence | Assumptions |
|---|---|---|---|---|
qwen3.8:27b |
4 | 11 | medium | 8 |
- 2026-10-06 18:25 UTC Fix developed Corrective change authored (2ebf29f93dd83dbd30739432fd0a28f5d8ae81c6): fix: [security] Make redis host and attachment download https://github.com/MISP/MISP/commit/2ebf29f93.patch
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:misp:misp_\\(malware_information_sharing_platform\\):*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"Server settings (app/Model/Server.php)",
"MISP.redis_host",
"Plugin.ZeroMQ_redis_host",
"SimpleBackgroundJobs.redis_host",
"download_attachments_on_load"
],
"product": "MISP",
"programFiles": [
"app/Model/Server.php"
],
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThanOrEqual": "2.5.48",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Logan Homolka"
},
{
"lang": "en",
"type": "reporter",
"value": "CERT.pl"
},
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 4.8"
},
{
"lang": "en",
"type": "coordinator",
"value": "CCB"
},
{
"lang": "en",
"type": "coordinator",
"value": "Alexandre Dulaunoy"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMISP exposes critical infrastructure settings\u2014specifically the Redis host addresses used by the core application, the ZeroMQ plugin, and the SimpleBackgroundJobs plugin\u2014through its web UI and API to site-admin users. The background job workers trust raw Redis job payloads without additional validation. An attacker who obtains a hijacked site-admin session (for example, through a stored cross-site scripting vulnerability) can modify the Redis host settings to point at an attacker-controlled Redis server and then restart the workers. Once the workers connect to the attacker\u0027s Redis instance, the attacker can inject malicious job payloads that the workers execute, achieving arbitrary command execution as the worker account. Additionally, the download_attachments_on_load setting, which controls inline attachment rendering, was modifiable through the same interface, allowing a hijacked session to re-enable a feature that could facilitate further client-side attacks. The vulnerability requires site-admin privileges and a prior session-compromise mechanism; it does not require unauthenticated access. The impact is remote code execution in the context of the MISP worker process and potential data exfiltration through the attacker-controlled Redis connection.\u003c/p\u003e"
}
],
"value": "MISP exposes critical infrastructure settings\u2014specifically the Redis host addresses used by the core application, the ZeroMQ plugin, and the SimpleBackgroundJobs plugin\u2014through its web UI and API to site-admin users. The background job workers trust raw Redis job payloads without additional validation. An attacker who obtains a hijacked site-admin session (for example, through a stored cross-site scripting vulnerability) can modify the Redis host settings to point at an attacker-controlled Redis server and then restart the workers. Once the workers connect to the attacker\u0027s Redis instance, the attacker can inject malicious job payloads that the workers execute, achieving arbitrary command execution as the worker account. Additionally, the download_attachments_on_load setting, which controls inline attachment rendering, was modifiable through the same interface, allowing a hijacked session to re-enable a feature that could facilitate further client-side attacks. The vulnerability requires site-admin privileges and a prior session-compromise mechanism; it does not require unauthenticated access. The impact is remote code execution in the context of the MISP worker process and potential data exfiltration through the attacker-controlled Redis connection."
}
],
"impacts": [
{
"capecId": "CAPEC-126",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-126 Session Fixation"
}
]
},
{
"capecId": "CAPEC-64",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-64 HTTP Request/Response Splitting"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"format": "SSVC",
"other": {
"content": {
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "Supplier",
"timestamp": "2026-10-06T18:56:14Z",
"version": "2.0.3"
},
"type": "SSVC"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-749",
"description": "CWE-749 Exposed Dangerous Method or Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "00000000-0000-4000-9000-000000000000"
},
"references": [
{
"name": "Security patch",
"tags": [
"patch"
],
"url": "https://github.com/MISP/MISP/commit/2ebf29f93"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe fix restricts the Redis host settings (MISP.redis_host, Plugin.ZeroMQ_redis_host, SimpleBackgroundJobs.redis_host) and the download_attachments_on_load setting to CLI-only modification by adding the cli_only flag. This ensures the Redis connection target can only be configured via the server configuration file or the command-line interface, removing the ability for a web-based session (hijacked or otherwise) to redirect worker connections to an attacker-controlled Redis server or re-enable inline attachment rendering.\u003c/p\u003e"
}
],
"value": "The fix restricts the Redis host settings (MISP.redis_host, Plugin.ZeroMQ_redis_host, SimpleBackgroundJobs.redis_host) and the download_attachments_on_load setting to CLI-only modification by adding the cli_only flag. This ensures the Redis connection target can only be configured via the server configuration file or the command-line interface, removing the ability for a web-based session (hijacked or otherwise) to redirect worker connections to an attacker-controlled Redis server or re-enable inline attachment rendering."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "MISP: Site-Admin Can Repoint Redis Workers to Attacker-Controlled Server via UI/API Configuration Change",
"x_gcve": [
{
"extensions": {
"bcp-05-x-01": {
"ai_annotations": [
{
"ai_level": "generated",
"description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
"gna_source": 1,
"models": [
{
"gna_source": 1,
"identifier": "qwen3.8:27b",
"name": "qwen3.8:27b",
"source": "ollama"
}
],
"review_status": "partial",
"scope": "record",
"tags": [
"ai-computer-assisted:llm-generated",
"ai-computer-assisted:classification"
]
}
]
},
"bcp-05-x-02": {
"x_patch2vuln": {
"assumptions": [
"The commit message states the attack requires a \u0027hijacked site-admin session (e.g. through stored XSS)\u0027; the stored XSS is assumed to be a separate, pre-existing vulnerability and is not part of this CVE\u0027s scope.",
"The commit message states workers \u0027trust raw Redis job payloads\u0027; the exact mechanism by which malicious Redis payloads lead to command execution is not detailed in the patch and is assumed based on the commit description.",
"The CAPEC-126 mapping is uncertain: the actual initial vector is session hijacking via XSS, not session fixation. No CAPEC pattern precisely captures \u0027authenticated configuration manipulation to redirect backend infrastructure.\u0027 CAPEC-126 was selected as the closest available match in the session-security family.",
"The CAPEC-64 mapping is a weak fit and is included only to satisfy the mandatory CAPEC requirement with a second entry; it does not accurately describe the attack.",
"Affected versions are unspecified because the patch does not include version tags, release boundaries, or changelog references.",
"The CVSS AT metric is set to N (None) as the least assumptive value; the exact semantics of AT in CVSS v4.0 relative to AC are not fully clarified in the available evidence.",
"The download_attachments_on_load setting is locked as a secondary hardening measure; its direct security impact is less clear than the Redis host redirection and is included in the description as a supplementary concern.",
"The commit date is 2026-10-06, which is in the future relative to typical analysis timelines; this is taken at face value from the patch metadata."
],
"capecRationale": [
{
"capecId": "CAPEC-126",
"rationale": "The commit message explicitly identifies a \u0027hijacked site-admin session\u0027 as the prerequisite attack vector, and the exploitation path relies on an authenticated session making API/UI calls to modify configuration. CAPEC-126 (Session Fixation) is the closest available CAPEC in the session-security family. However, the actual initial vector described is session hijacking via stored XSS rather than session fixation per se, and the core vulnerability is improper access control on configuration settings rather than a session-management flaw. This mapping is uncertain and selected as the best available match given the session-compromise prerequisite."
},
{
"capecId": "CAPEC-64",
"rationale": "This mapping is included only as a secondary consideration and is a weak fit. The attack does not involve CRLF injection or HTTP splitting. It is listed to acknowledge that no CAPEC pattern precisely captures \u0027authenticated configuration manipulation to redirect backend infrastructure connections.\u0027 CAPEC-64 is the closest in the \u0027protocol manipulation\u0027 family but is not a strong match. This mapping is highly uncertain."
}
],
"commit": "2ebf29f93dd83dbd30739432fd0a28f5d8ae81c6",
"confidence": "medium",
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Logan Homolka"
},
{
"lang": "en",
"type": "reporter",
"value": "CERT.pl"
},
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 4.8"
}
],
"cvssRationale": "AV:N: The settings are modified via the web UI or API over the network. AC:H: Exploitation requires a prior session-compromise mechanism (e.g., stored XSS), knowledge of MISP\u0027s internal API, and the ability to restart background workers\u2014multiple specific conditions must align. AT:N: No additional attack complexity beyond what AC captures. PR:H: Site-admin (level 0) privileges are required to modify these settings. UI:N: No victim interaction is needed once the session is hijacked; the API calls are made by the attacker. VC:N: No direct confidentiality impact on MISP itself. VI:H: MISP\u0027s configuration integrity is fundamentally compromised\u2014the Redis connection target is redirected to an attacker-controlled server. VA:N: No direct availability impact on MISP. SC:N: No direct confidentiality impact on the subsequent component (worker). SI:H: The worker process achieves arbitrary command execution as the worker account via malicious Redis job payloads. SA:N: No availability impact on the subsequent component.",
"fixSummary": "The fix restricts the Redis host settings (MISP.redis_host, Plugin.ZeroMQ_redis_host, SimpleBackgroundJobs.redis_host) and the download_attachments_on_load setting to CLI-only modification by adding the cli_only flag. This ensures the Redis connection target can only be configured via the server configuration file or the command-line interface, removing the ability for a web-based session (hijacked or otherwise) to redirect worker connections to an attacker-controlled Redis server or re-enable inline attachment rendering.",
"generatedAt": "2026-10-06T18:56:14.991485Z",
"generator": "patch2vuln.py",
"model": "qwen3.8:27b",
"modelComparison": {
"rankings": [
{
"agreementScore": 11,
"assumptionCount": 8,
"confidence": "medium",
"model": "qwen3.8:27b",
"score": 4
}
],
"selectedModel": "qwen3.8:27b",
"selectionMethod": "deterministic-consensus-v1",
"selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
},
"patchSha256": "8262490f9bccf2a4bc3e35074b0798f0cbfeefc14e5e9fc876788ac1b09eabce",
"patchSummary": "In app/Model/Server.php, the patch adds \u0027cli_only\u0027 =\u003e true to four setting definitions within the generateServerSettings() method: the download_attachments_on_load boolean setting (around line 6274), the MISP.redis_host string setting (around line 7037), the Plugin.ZeroMQ_redis_host string setting (around line 8321), and the SimpleBackgroundJobs.redis_host string setting (around line 9050). Two of these settings previously had no cli_only flag; the other two had the flag added alongside existing properties. The change totals 6 insertions and 2 deletions across the single file.",
"patchTruncated": false,
"patches": [
{
"commit": "2ebf29f93dd83dbd30739432fd0a28f5d8ae81c6",
"date": "Tue, 6 Oct 2026 20:25:04 +0200",
"patchSha256": "8262490f9bccf2a4bc3e35074b0798f0cbfeefc14e5e9fc876788ac1b09eabce",
"source": "https://github.com/MISP/MISP/commit/2ebf29f93.patch",
"sourceUrl": "https://github.com/MISP/MISP/commit/2ebf29f93.patch",
"subject": "fix: [security] Make redis host and attachment download"
}
],
"source": "https://github.com/MISP/MISP/commit/2ebf29f93.patch",
"ssvc": {
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "Supplier",
"timestamp": "2026-10-06T18:56:14Z",
"version": "2.0.3"
},
"subject": "fix: [security] Make redis host and attachment download",
"weaknessRationale": [
{
"cweId": "CWE-284",
"rationale": "The Redis host and attachment rendering settings were accessible for modification via the web UI/API by site-admin users, when they should have been restricted to CLI or server configuration only. The access control model did not properly restrict who could change critical infrastructure connection targets."
},
{
"cweId": "CWE-749",
"rationale": "The web interface exposed the ability to change the Redis connection endpoint and re-enable inline attachment rendering\u2014operations that are dangerous because they redirect trusted backend workers to an untrusted server and alter client-side rendering behavior. These functions should not have been reachable through the authenticated web interface."
}
]
}
},
"bcp-05-x-03": {
"x_timeline": {
"events": [
{
"description": "Corrective change authored (2ebf29f93dd83dbd30739432fd0a28f5d8ae81c6): fix: [security] Make redis host and attachment download",
"id": "evt-fix-developed-1",
"references": [
"https://github.com/MISP/MISP/commit/2ebf29f93.patch"
],
"timestamp": "2026-10-06T18:25:04Z",
"type": "fix-developed"
}
]
}
}
},
"recordType": "advisory",
"vulnId": "gcve-1-2026-20117"
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "00000000-0000-4000-9000-000000000000",
"cveId": "CVE-2026-106513",
"datePublished": "2026-10-06T18:58:00.000Z",
"dateReserved": "2026-10-06T18:58:00.000Z",
"dateUpdated": "2026-10-06T19:03:57.387737Z",
"requesterUserId": "00000000-0000-4000-9000-000000000000",
"serial": 1,
"state": "PUBLISHED",
"vulnId": "gcve-1-2026-20117"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-20073 (GCVE-0-2026-20073)
Vulnerability from cvelistv5 – Published: 2026-03-04 17:52 – Updated: 2026-03-04 18:07
VLAI
EPSS
VEX
Title
Cisco Secure Firewall Adaptive Security Appliance Software and Cisco Secure Firewall Threat Defense Software Access Control List Bypass Vulnerability
Summary
A vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to send traffic that should be denied through an affected device.
This vulnerability is due to improper error handling when an affected device that is joining a cluster runs out of memory while replicating access control rules. An attacker could exploit this vulnerability by sending traffic that should be blocked through the device. A successful exploit could allow the attacker to bypass access controls and reach devices in protected networks.
Severity
5.8 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-04 18:07 UTC
CWE
- CWE-284 - Improper Access Control
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cisco | Cisco Secure Firewall Adaptive Security Appliance (ASA) Software |
Affected:
9.12.3
Affected: 9.12.1 Affected: 9.12.2 Affected: 9.12.4 Affected: 9.12.3.2 Affected: 9.12.3.7 Affected: 9.12.2.5 Affected: 9.12.3.12 Affected: 9.12.1.3 Affected: 9.12.2.4 Affected: 9.12.1.2 Affected: 9.12.2.9 Affected: 9.12.3.9 Affected: 9.12.2.1 Affected: 9.12.4.2 Affected: 9.12.4.4 Affected: 9.12.4.7 Affected: 9.12.4.8 Affected: 9.12.4.10 Affected: 9.12.4.13 Affected: 9.12.4.18 Affected: 9.12.4.24 Affected: 9.16.1 Affected: 9.12.4.26 Affected: 9.16.1.28 Affected: 9.12.4.29 Affected: 9.16.2 Affected: 9.12.4.30 Affected: 9.16.2.3 Affected: 9.12.4.35 Affected: 9.16.2.7 Affected: 9.12.4.37 Affected: 9.17.1 Affected: 9.16.2.11 Affected: 9.16.2.13 Affected: 9.12.4.39 Affected: 9.12.4.38 Affected: 9.16.2.14 Affected: 9.17.1.7 Affected: 9.12.4.40 Affected: 9.16.3.3 Affected: 9.16.3 Affected: 9.16.3.14 Affected: 9.17.1.9 Affected: 9.12.4.41 Affected: 9.17.1.10 Affected: 9.18.1 Affected: 9.12.4.47 Affected: 9.16.3.15 Affected: 9.18.1.3 Affected: 9.17.1.11 Affected: 9.12.4.48 Affected: 9.18.2 Affected: 9.16.3.19 Affected: 9.17.1.13 Affected: 9.12.4.50 Affected: 9.17.1.15 Affected: 9.12.4.52 Affected: 9.16.3.23 Affected: 9.18.2.5 Affected: 9.16.4 Affected: 9.12.4.54 Affected: 9.17.1.20 Affected: 9.18.2.7 Affected: 9.19.1 Affected: 9.16.4.9 Affected: 9.12.4.55 Affected: 9.18.2.8 Affected: 9.16.4.14 Affected: 9.18.3 Affected: 9.19.1.5 Affected: 9.12.4.56 Affected: 9.17.1.30 Affected: 9.19.1.9 Affected: 9.18.3.39 Affected: 9.16.4.19 Affected: 9.12.4.58 Affected: 9.19.1.12 Affected: 9.18.3.46 Affected: 9.16.4.27 Affected: 9.19.1.18 Affected: 9.18.3.53 Affected: 9.18.3.55 Affected: 9.16.4.38 Affected: 9.17.1.33 Affected: 9.12.4.62 Affected: 9.16.4.39 Affected: 9.18.3.56 Affected: 9.20.1 Affected: 9.16.4.42 Affected: 9.19.1.22 Affected: 9.18.4 Affected: 9.20.1.5 Affected: 9.18.4.5 Affected: 9.19.1.24 Affected: 9.16.4.48 Affected: 9.18.4.8 Affected: 9.20.2 Affected: 9.19.1.27 Affected: 9.12.4.65 Affected: 9.16.4.55 Affected: 9.18.4.22 Affected: 9.20.2.10 Affected: 9.16.4.57 Affected: 9.19.1.28 Affected: 9.17.1.39 Affected: 9.12.4.67 Affected: 9.18.4.24 Affected: 9.20.2.21 Affected: 9.16.4.61 Affected: 9.19.1.31 Affected: 9.18.4.29 Affected: 9.20.2.22 Affected: 9.16.4.62 Affected: 9.18.4.34 Affected: 9.20.3 Affected: 9.16.4.67 Affected: 9.16.4.70 Affected: 9.18.4.40 Affected: 9.23.1 Affected: 9.22.1.1 Affected: 9.16.4.71 Affected: 9.20.3.4 Affected: 9.18.4.47 Affected: 9.20.3.7 Affected: 9.17.1.45 Affected: 9.19.1.37 Affected: 9.17.1.46 Affected: 9.16.4.76 Affected: 9.20.3.9 Affected: 9.19.1.38 Affected: 9.18.4.50 Affected: 9.22.1.3 Affected: 9.20.3.10 Affected: 9.22.1.2 Affected: 9.18.4.52 Affected: 9.20.3.13 Affected: 9.22.1.6 Affected: 9.18.4.53 Affected: 9.16.4.82 Affected: 9.22.2 Affected: 9.20.3.16 Affected: 9.19.1.42 Affected: 9.18.4.57 Affected: 9.16.4.84 Affected: 9.23.1.3 Affected: 9.20.3.20 Affected: 9.22.2.4 Affected: 9.23.1.7 Affected: 9.20.4 Affected: 9.22.2.9 Affected: 9.23.1.13 Affected: 9.20.4.7 Affected: 9.22.2.13 Affected: 9.18.4.66 Affected: 9.20.4.10 Affected: 9.23.1.19 Affected: 9.18.4.67 Affected: 9.18.4.68 |
|
| Cisco | Cisco Secure Firewall Threat Defense (FTD) Software |
Affected:
6.4.0.1
Affected: 6.4.0.2 Affected: 6.4.0.5 Affected: 6.4.0 Affected: 6.4.0.3 Affected: 6.4.0.4 Affected: 6.4.0.6 Affected: 6.4.0.7 Affected: 6.4.0.8 Affected: 6.4.0.9 Affected: 6.4.0.10 Affected: 6.4.0.11 Affected: 6.4.0.12 Affected: 7.0.0 Affected: 7.0.0.1 Affected: 7.0.1 Affected: 7.1.0 Affected: 6.4.0.13 Affected: 7.0.1.1 Affected: 6.4.0.14 Affected: 7.1.0.1 Affected: 7.0.2 Affected: 6.4.0.15 Affected: 7.2.0 Affected: 7.0.2.1 Affected: 7.0.3 Affected: 7.1.0.2 Affected: 7.2.0.1 Affected: 7.0.4 Affected: 7.2.1 Affected: 7.0.5 Affected: 6.4.0.16 Affected: 7.3.0 Affected: 7.2.2 Affected: 7.2.3 Affected: 7.3.1 Affected: 7.1.0.3 Affected: 7.2.4 Affected: 7.0.6 Affected: 7.2.5 Affected: 7.2.4.1 Affected: 7.3.1.1 Affected: 7.4.0 Affected: 6.4.0.17 Affected: 7.0.6.1 Affected: 7.2.5.1 Affected: 7.4.1 Affected: 7.2.6 Affected: 7.0.6.2 Affected: 7.4.1.1 Affected: 6.4.0.18 Affected: 7.2.7 Affected: 7.2.5.2 Affected: 7.3.1.2 Affected: 7.2.8 Affected: 7.6.0 Affected: 7.4.2 Affected: 7.2.8.1 Affected: 7.0.6.3 Affected: 7.4.2.1 Affected: 7.2.9 Affected: 7.0.7 Affected: 7.7.0 Affected: 7.4.2.2 Affected: 7.2.10 Affected: 7.6.1 Affected: 7.4.2.3 Affected: 7.0.8 Affected: 7.6.2 Affected: 7.7.10 Affected: 7.0.8.1 Affected: 7.6.2.1 Affected: 7.7.10.1 Affected: 7.4.2.4 Affected: 7.2.10.2 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-20073",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-04T18:07:40.586427Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-04T18:07:54.606Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Cisco Secure Firewall Adaptive Security Appliance (ASA) Software",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "9.12.3"
},
{
"status": "affected",
"version": "9.12.1"
},
{
"status": "affected",
"version": "9.12.2"
},
{
"status": "affected",
"version": "9.12.4"
},
{
"status": "affected",
"version": "9.12.3.2"
},
{
"status": "affected",
"version": "9.12.3.7"
},
{
"status": "affected",
"version": "9.12.2.5"
},
{
"status": "affected",
"version": "9.12.3.12"
},
{
"status": "affected",
"version": "9.12.1.3"
},
{
"status": "affected",
"version": "9.12.2.4"
},
{
"status": "affected",
"version": "9.12.1.2"
},
{
"status": "affected",
"version": "9.12.2.9"
},
{
"status": "affected",
"version": "9.12.3.9"
},
{
"status": "affected",
"version": "9.12.2.1"
},
{
"status": "affected",
"version": "9.12.4.2"
},
{
"status": "affected",
"version": "9.12.4.4"
},
{
"status": "affected",
"version": "9.12.4.7"
},
{
"status": "affected",
"version": "9.12.4.8"
},
{
"status": "affected",
"version": "9.12.4.10"
},
{
"status": "affected",
"version": "9.12.4.13"
},
{
"status": "affected",
"version": "9.12.4.18"
},
{
"status": "affected",
"version": "9.12.4.24"
},
{
"status": "affected",
"version": "9.16.1"
},
{
"status": "affected",
"version": "9.12.4.26"
},
{
"status": "affected",
"version": "9.16.1.28"
},
{
"status": "affected",
"version": "9.12.4.29"
},
{
"status": "affected",
"version": "9.16.2"
},
{
"status": "affected",
"version": "9.12.4.30"
},
{
"status": "affected",
"version": "9.16.2.3"
},
{
"status": "affected",
"version": "9.12.4.35"
},
{
"status": "affected",
"version": "9.16.2.7"
},
{
"status": "affected",
"version": "9.12.4.37"
},
{
"status": "affected",
"version": "9.17.1"
},
{
"status": "affected",
"version": "9.16.2.11"
},
{
"status": "affected",
"version": "9.16.2.13"
},
{
"status": "affected",
"version": "9.12.4.39"
},
{
"status": "affected",
"version": "9.12.4.38"
},
{
"status": "affected",
"version": "9.16.2.14"
},
{
"status": "affected",
"version": "9.17.1.7"
},
{
"status": "affected",
"version": "9.12.4.40"
},
{
"status": "affected",
"version": "9.16.3.3"
},
{
"status": "affected",
"version": "9.16.3"
},
{
"status": "affected",
"version": "9.16.3.14"
},
{
"status": "affected",
"version": "9.17.1.9"
},
{
"status": "affected",
"version": "9.12.4.41"
},
{
"status": "affected",
"version": "9.17.1.10"
},
{
"status": "affected",
"version": "9.18.1"
},
{
"status": "affected",
"version": "9.12.4.47"
},
{
"status": "affected",
"version": "9.16.3.15"
},
{
"status": "affected",
"version": "9.18.1.3"
},
{
"status": "affected",
"version": "9.17.1.11"
},
{
"status": "affected",
"version": "9.12.4.48"
},
{
"status": "affected",
"version": "9.18.2"
},
{
"status": "affected",
"version": "9.16.3.19"
},
{
"status": "affected",
"version": "9.17.1.13"
},
{
"status": "affected",
"version": "9.12.4.50"
},
{
"status": "affected",
"version": "9.17.1.15"
},
{
"status": "affected",
"version": "9.12.4.52"
},
{
"status": "affected",
"version": "9.16.3.23"
},
{
"status": "affected",
"version": "9.18.2.5"
},
{
"status": "affected",
"version": "9.16.4"
},
{
"status": "affected",
"version": "9.12.4.54"
},
{
"status": "affected",
"version": "9.17.1.20"
},
{
"status": "affected",
"version": "9.18.2.7"
},
{
"status": "affected",
"version": "9.19.1"
},
{
"status": "affected",
"version": "9.16.4.9"
},
{
"status": "affected",
"version": "9.12.4.55"
},
{
"status": "affected",
"version": "9.18.2.8"
},
{
"status": "affected",
"version": "9.16.4.14"
},
{
"status": "affected",
"version": "9.18.3"
},
{
"status": "affected",
"version": "9.19.1.5"
},
{
"status": "affected",
"version": "9.12.4.56"
},
{
"status": "affected",
"version": "9.17.1.30"
},
{
"status": "affected",
"version": "9.19.1.9"
},
{
"status": "affected",
"version": "9.18.3.39"
},
{
"status": "affected",
"version": "9.16.4.19"
},
{
"status": "affected",
"version": "9.12.4.58"
},
{
"status": "affected",
"version": "9.19.1.12"
},
{
"status": "affected",
"version": "9.18.3.46"
},
{
"status": "affected",
"version": "9.16.4.27"
},
{
"status": "affected",
"version": "9.19.1.18"
},
{
"status": "affected",
"version": "9.18.3.53"
},
{
"status": "affected",
"version": "9.18.3.55"
},
{
"status": "affected",
"version": "9.16.4.38"
},
{
"status": "affected",
"version": "9.17.1.33"
},
{
"status": "affected",
"version": "9.12.4.62"
},
{
"status": "affected",
"version": "9.16.4.39"
},
{
"status": "affected",
"version": "9.18.3.56"
},
{
"status": "affected",
"version": "9.20.1"
},
{
"status": "affected",
"version": "9.16.4.42"
},
{
"status": "affected",
"version": "9.19.1.22"
},
{
"status": "affected",
"version": "9.18.4"
},
{
"status": "affected",
"version": "9.20.1.5"
},
{
"status": "affected",
"version": "9.18.4.5"
},
{
"status": "affected",
"version": "9.19.1.24"
},
{
"status": "affected",
"version": "9.16.4.48"
},
{
"status": "affected",
"version": "9.18.4.8"
},
{
"status": "affected",
"version": "9.20.2"
},
{
"status": "affected",
"version": "9.19.1.27"
},
{
"status": "affected",
"version": "9.12.4.65"
},
{
"status": "affected",
"version": "9.16.4.55"
},
{
"status": "affected",
"version": "9.18.4.22"
},
{
"status": "affected",
"version": "9.20.2.10"
},
{
"status": "affected",
"version": "9.16.4.57"
},
{
"status": "affected",
"version": "9.19.1.28"
},
{
"status": "affected",
"version": "9.17.1.39"
},
{
"status": "affected",
"version": "9.12.4.67"
},
{
"status": "affected",
"version": "9.18.4.24"
},
{
"status": "affected",
"version": "9.20.2.21"
},
{
"status": "affected",
"version": "9.16.4.61"
},
{
"status": "affected",
"version": "9.19.1.31"
},
{
"status": "affected",
"version": "9.18.4.29"
},
{
"status": "affected",
"version": "9.20.2.22"
},
{
"status": "affected",
"version": "9.16.4.62"
},
{
"status": "affected",
"version": "9.18.4.34"
},
{
"status": "affected",
"version": "9.20.3"
},
{
"status": "affected",
"version": "9.16.4.67"
},
{
"status": "affected",
"version": "9.16.4.70"
},
{
"status": "affected",
"version": "9.18.4.40"
},
{
"status": "affected",
"version": "9.23.1"
},
{
"status": "affected",
"version": "9.22.1.1"
},
{
"status": "affected",
"version": "9.16.4.71"
},
{
"status": "affected",
"version": "9.20.3.4"
},
{
"status": "affected",
"version": "9.18.4.47"
},
{
"status": "affected",
"version": "9.20.3.7"
},
{
"status": "affected",
"version": "9.17.1.45"
},
{
"status": "affected",
"version": "9.19.1.37"
},
{
"status": "affected",
"version": "9.17.1.46"
},
{
"status": "affected",
"version": "9.16.4.76"
},
{
"status": "affected",
"version": "9.20.3.9"
},
{
"status": "affected",
"version": "9.19.1.38"
},
{
"status": "affected",
"version": "9.18.4.50"
},
{
"status": "affected",
"version": "9.22.1.3"
},
{
"status": "affected",
"version": "9.20.3.10"
},
{
"status": "affected",
"version": "9.22.1.2"
},
{
"status": "affected",
"version": "9.18.4.52"
},
{
"status": "affected",
"version": "9.20.3.13"
},
{
"status": "affected",
"version": "9.22.1.6"
},
{
"status": "affected",
"version": "9.18.4.53"
},
{
"status": "affected",
"version": "9.16.4.82"
},
{
"status": "affected",
"version": "9.22.2"
},
{
"status": "affected",
"version": "9.20.3.16"
},
{
"status": "affected",
"version": "9.19.1.42"
},
{
"status": "affected",
"version": "9.18.4.57"
},
{
"status": "affected",
"version": "9.16.4.84"
},
{
"status": "affected",
"version": "9.23.1.3"
},
{
"status": "affected",
"version": "9.20.3.20"
},
{
"status": "affected",
"version": "9.22.2.4"
},
{
"status": "affected",
"version": "9.23.1.7"
},
{
"status": "affected",
"version": "9.20.4"
},
{
"status": "affected",
"version": "9.22.2.9"
},
{
"status": "affected",
"version": "9.23.1.13"
},
{
"status": "affected",
"version": "9.20.4.7"
},
{
"status": "affected",
"version": "9.22.2.13"
},
{
"status": "affected",
"version": "9.18.4.66"
},
{
"status": "affected",
"version": "9.20.4.10"
},
{
"status": "affected",
"version": "9.23.1.19"
},
{
"status": "affected",
"version": "9.18.4.67"
},
{
"status": "affected",
"version": "9.18.4.68"
}
]
},
{
"defaultStatus": "unknown",
"product": "Cisco Secure Firewall Threat Defense (FTD) Software",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "6.4.0.1"
},
{
"status": "affected",
"version": "6.4.0.2"
},
{
"status": "affected",
"version": "6.4.0.5"
},
{
"status": "affected",
"version": "6.4.0"
},
{
"status": "affected",
"version": "6.4.0.3"
},
{
"status": "affected",
"version": "6.4.0.4"
},
{
"status": "affected",
"version": "6.4.0.6"
},
{
"status": "affected",
"version": "6.4.0.7"
},
{
"status": "affected",
"version": "6.4.0.8"
},
{
"status": "affected",
"version": "6.4.0.9"
},
{
"status": "affected",
"version": "6.4.0.10"
},
{
"status": "affected",
"version": "6.4.0.11"
},
{
"status": "affected",
"version": "6.4.0.12"
},
{
"status": "affected",
"version": "7.0.0"
},
{
"status": "affected",
"version": "7.0.0.1"
},
{
"status": "affected",
"version": "7.0.1"
},
{
"status": "affected",
"version": "7.1.0"
},
{
"status": "affected",
"version": "6.4.0.13"
},
{
"status": "affected",
"version": "7.0.1.1"
},
{
"status": "affected",
"version": "6.4.0.14"
},
{
"status": "affected",
"version": "7.1.0.1"
},
{
"status": "affected",
"version": "7.0.2"
},
{
"status": "affected",
"version": "6.4.0.15"
},
{
"status": "affected",
"version": "7.2.0"
},
{
"status": "affected",
"version": "7.0.2.1"
},
{
"status": "affected",
"version": "7.0.3"
},
{
"status": "affected",
"version": "7.1.0.2"
},
{
"status": "affected",
"version": "7.2.0.1"
},
{
"status": "affected",
"version": "7.0.4"
},
{
"status": "affected",
"version": "7.2.1"
},
{
"status": "affected",
"version": "7.0.5"
},
{
"status": "affected",
"version": "6.4.0.16"
},
{
"status": "affected",
"version": "7.3.0"
},
{
"status": "affected",
"version": "7.2.2"
},
{
"status": "affected",
"version": "7.2.3"
},
{
"status": "affected",
"version": "7.3.1"
},
{
"status": "affected",
"version": "7.1.0.3"
},
{
"status": "affected",
"version": "7.2.4"
},
{
"status": "affected",
"version": "7.0.6"
},
{
"status": "affected",
"version": "7.2.5"
},
{
"status": "affected",
"version": "7.2.4.1"
},
{
"status": "affected",
"version": "7.3.1.1"
},
{
"status": "affected",
"version": "7.4.0"
},
{
"status": "affected",
"version": "6.4.0.17"
},
{
"status": "affected",
"version": "7.0.6.1"
},
{
"status": "affected",
"version": "7.2.5.1"
},
{
"status": "affected",
"version": "7.4.1"
},
{
"status": "affected",
"version": "7.2.6"
},
{
"status": "affected",
"version": "7.0.6.2"
},
{
"status": "affected",
"version": "7.4.1.1"
},
{
"status": "affected",
"version": "6.4.0.18"
},
{
"status": "affected",
"version": "7.2.7"
},
{
"status": "affected",
"version": "7.2.5.2"
},
{
"status": "affected",
"version": "7.3.1.2"
},
{
"status": "affected",
"version": "7.2.8"
},
{
"status": "affected",
"version": "7.6.0"
},
{
"status": "affected",
"version": "7.4.2"
},
{
"status": "affected",
"version": "7.2.8.1"
},
{
"status": "affected",
"version": "7.0.6.3"
},
{
"status": "affected",
"version": "7.4.2.1"
},
{
"status": "affected",
"version": "7.2.9"
},
{
"status": "affected",
"version": "7.0.7"
},
{
"status": "affected",
"version": "7.7.0"
},
{
"status": "affected",
"version": "7.4.2.2"
},
{
"status": "affected",
"version": "7.2.10"
},
{
"status": "affected",
"version": "7.6.1"
},
{
"status": "affected",
"version": "7.4.2.3"
},
{
"status": "affected",
"version": "7.0.8"
},
{
"status": "affected",
"version": "7.6.2"
},
{
"status": "affected",
"version": "7.7.10"
},
{
"status": "affected",
"version": "7.0.8.1"
},
{
"status": "affected",
"version": "7.6.2.1"
},
{
"status": "affected",
"version": "7.7.10.1"
},
{
"status": "affected",
"version": "7.4.2.4"
},
{
"status": "affected",
"version": "7.2.10.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to send traffic that should be denied through an affected device.\r\n\r\nThis vulnerability is due to improper error handling when an affected device that is joining a cluster runs out of memory while replicating access control rules. An attacker could exploit this vulnerability by sending traffic that should be blocked through the device. A successful exploit could allow the attacker to bypass access controls and reach devices in protected networks."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Control",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-04T17:52:06.331Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-asaftd-aclbypass-dos-CVxVRSvQ",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-aclbypass-dos-CVxVRSvQ"
}
],
"source": {
"advisory": "cisco-sa-asaftd-aclbypass-dos-CVxVRSvQ",
"defects": [
"CSCwq78991"
],
"discovery": "EXTERNAL"
},
"title": "Cisco Secure Firewall Adaptive Security Appliance Software and Cisco Secure Firewall Threat Defense Software Access Control List Bypass Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2026-20073",
"datePublished": "2026-03-04T17:52:06.331Z",
"dateReserved": "2025-10-08T11:59:15.362Z",
"dateUpdated": "2026-03-04T18:07:54.606Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1-2026-20057 (CVE-2026-94393)
Vulnerability from gna-1 – Published: 2026-09-21 13:13 – Updated: 2026-09-21 13:13
VLAI
EPSS
VEX
Title
MISP Event Report Cross-Event Reparenting via Unscoped UUID Resolution in editReport
Summary
When a user creates or edits a report inside an event, MISP can identify an existing report using its UUID without properly checking whether that report actually belongs to the same event.
As a result, a user who has editing rights on one event could potentially move a report from another event into their own event, as long as they know or can guess the report’s UUID. Once moved, they could view and change information that they were not originally allowed to access.
The vulnerability requires the attacker to have editor access to at least one event and to know or discover a valid report UUID.
The main impact is that private event reports could be exposed or modified across event boundaries, bypassing MISP’s normal access restrictions.
Version affected: <2.5.47
Severity
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/MISP/MISP/commit/43665b9bb | patch |
GCVE extensions
AI-generated
Confidence: medium
Model
qwen3.8:27b
advisory
bcp-05-x-01bcp-05-x-02
Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.
ai-computer-assisted:llm-generatedai-computer-assisted:classification
| Model | Source | Identifier |
|---|---|---|
| qwen3.8:27b | ollama | qwen3.8:27b |
- Generator
-
patch2vuln.pyon 2026-09-21 13:01 - Model
qwen3.8:27b- Input
-
https://github.com/MISP/MISP/commit/43665b9bb.patch
2306bd95d16b… - Confidence
- medium
| Commit | Subject | Patch SHA-256 |
|---|---|---|
43665b9bb6bd
|
fix: [security] Refuse to adopt an event report that belongs | 2306bd95d16b… |
Fix summary
The fix adds an ownership check in editReport: before adopting an existing report found by UUID, the code now verifies that the report's event_id matches the event being edited. If the UUID resolves to a report belonging to a different event, the operation is rejected with an error message, preventing cross-event reparenting, unauthorized read, and unauthorized overwrite of reports.
Patch summary
In app/Model/EventReport.php, the editReport method's else-branch (handling an existing report found by UUID) now includes an 11-line guard: it compares (string)$existingReport['EventReport']['event_id'] against (string)$eventId and, on mismatch, appends an error string and returns early, preventing the subsequent assignment of the foreign report's ID to the current event's report record.
CVSS rationale
AV:N: MISP is a network-accessible web application. AC:L: the attacker only needs to supply a known/guessed UUID in a standard edit request; no race or complex condition. AT:N: no manipulation of the target environment is required. PR:L: the attacker must be an authenticated user with editor role on at least one event. UI:N: no victim interaction is needed. VC:N/VI:N/VA:N: the MISP application itself (its configuration, credentials, availability) is not directly impacted. SC:H: the attacker gains read access to private report data in events they cannot otherwise see. SI:H: the attacker can overwrite and modify report data belonging to other events. SA:N: no safety-system impact.
Weakness rationale
- CWE-639 The report UUID is a user-controlled key resolved globally without scoping to the caller's event context. The system failed to verify that the referenced object (report) belongs to the event the caller is authorized to edit, allowing cross-event access.
- CWE-284 The broader category applies: MISP's per-event access control model was bypassed because the editReport path did not enforce that a report UUID maps to the same event the caller is operating on.
Attack pattern rationale
- CAPEC-174 The edge case of a UUID belonging to a different event was not handled: the code assumed any UUID found in the global table belonged to the current event. The attacker exploits this unhandled edge case to reparent a foreign report. This is the closest CAPEC; a more specific 'IDOR' or 'broken object reference' CAPEC does not exist in the CAPEC catalog, so CAPEC-174 is the best available match.
Assumptions to verify
- The affected version range is inferred from the tag_version_boundary (v2.5.47, 56 commits after fix); the exact first affected and first fixed release versions are not stated in the patch and are marked unspecified.
- PR:L assumes the attacker needs at minimum editor-level access to one event; the patch does not specify whether viewer-level access could also trigger the code path, but the commit message explicitly references 'an event editor'.
- CAPEC-174 is selected as the closest available attack pattern; no CAPEC entry specifically covers IDOR or broken object reference resolution, so the mapping is approximate.
- The CVSS sub-component impact (SC:H, SI:H) assumes the event report data constitutes a distinct data asset whose confidentiality and integrity are the primary impact, rather than the MISP application's own state.
- The commit date (2026-09-16) and tag boundary are taken at face value from the supplied metadata; no independent verification of release timing was performed.
Model comparison
Selected qwen3.8:27b
by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.
| Model | Score | Agreement | Confidence | Assumptions |
|---|---|---|---|---|
qwen3.8:27b |
5 | 9 | medium | 5 |
{
"containers": {
"cna": {
"affected": [
{
"modules": [
"app/Model/EventReport.php"
],
"product": "MISP",
"programFiles": [
"app/Model/EventReport.php"
],
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThan": "2.5.47",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 4.8"
},
{
"lang": "en",
"type": "reporter",
"value": "David Andr\u00e9"
},
{
"lang": "en",
"type": "reporter",
"value": "Jeroen Pinoy"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003c/div\u003e\u003cp\u003eWhen a user creates or edits a report inside an event, MISP can identify an existing report using its UUID without properly checking whether that report actually belongs to the same event.\u003c/p\u003e\u003cp\u003eAs a result, a user who has editing rights on one event could potentially move a report from another event into their own event, as long as they know or can guess the report\u2019s UUID. Once moved, they could view and change information that they were not originally allowed to access.\u003c/p\u003e\u003cp\u003eThe vulnerability requires the attacker to have editor access to at least one event and to know or discover a valid report UUID.\u003c/p\u003e\u003cp\u003eThe main impact is that private event reports could be exposed or modified across event boundaries, bypassing MISP\u2019s normal access restrictions.\u003c/p\u003e\u003cp\u003eVersion affected: \u0026lt;2.5.47\u003c/p\u003e\u003cdiv\u003e\u003c/div\u003e"
}
],
"value": "When a user creates or edits a report inside an event, MISP can identify an existing report using its UUID without properly checking whether that report actually belongs to the same event.\n\nAs a result, a user who has editing rights on one event could potentially move a report from another event into their own event, as long as they know or can guess the report\u2019s UUID. Once moved, they could view and change information that they were not originally allowed to access.\n\nThe vulnerability requires the attacker to have editor access to at least one event and to know or discover a valid report UUID.\n\nThe main impact is that private event reports could be exposed or modified across event boundaries, bypassing MISP\u2019s normal access restrictions.\n\nVersion affected: \u003c2.5.47"
}
],
"impacts": [
{
"capecId": "CAPEC-174",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-174 Exploiting Incorrectly Handled Edge Cases"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "00000000-0000-4000-9000-000000000000"
},
"references": [
{
"name": "Security patch",
"tags": [
"patch"
],
"url": "https://github.com/MISP/MISP/commit/43665b9bb"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe fix adds an ownership check in editReport: before adopting an existing report found by UUID, the code now verifies that the report\u0027s event_id matches the event being edited. If the UUID resolves to a report belonging to a different event, the operation is rejected with an error message, preventing cross-event reparenting, unauthorized read, and unauthorized overwrite of reports.\u003c/p\u003e"
}
],
"value": "The fix adds an ownership check in editReport: before adopting an existing report found by UUID, the code now verifies that the report\u0027s event_id matches the event being edited. If the UUID resolves to a report belonging to a different event, the operation is rejected with an error message, preventing cross-event reparenting, unauthorized read, and unauthorized overwrite of reports."
}
],
"title": "MISP Event Report Cross-Event Reparenting via Unscoped UUID Resolution in editReport",
"x_gcve": [
{
"extensions": {
"bcp-05-x-01": {
"ai_annotations": [
{
"ai_level": "generated",
"description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
"gna_source": 1,
"models": [
{
"gna_source": 1,
"identifier": "qwen3.8:27b",
"name": "qwen3.8:27b",
"source": "ollama"
}
],
"review_status": "review",
"scope": "record",
"tags": [
"ai-computer-assisted:llm-generated",
"ai-computer-assisted:classification"
]
}
]
},
"bcp-05-x-02": {
"x_patch2vuln": {
"assumptions": [
"The affected version range is inferred from the tag_version_boundary (v2.5.47, 56 commits after fix); the exact first affected and first fixed release versions are not stated in the patch and are marked unspecified.",
"PR:L assumes the attacker needs at minimum editor-level access to one event; the patch does not specify whether viewer-level access could also trigger the code path, but the commit message explicitly references \u0027an event editor\u0027.",
"CAPEC-174 is selected as the closest available attack pattern; no CAPEC entry specifically covers IDOR or broken object reference resolution, so the mapping is approximate.",
"The CVSS sub-component impact (SC:H, SI:H) assumes the event report data constitutes a distinct data asset whose confidentiality and integrity are the primary impact, rather than the MISP application\u0027s own state.",
"The commit date (2026-09-16) and tag boundary are taken at face value from the supplied metadata; no independent verification of release timing was performed."
],
"capecRationale": [
{
"capecId": "CAPEC-174",
"rationale": "The edge case of a UUID belonging to a different event was not handled: the code assumed any UUID found in the global table belonged to the current event. The attacker exploits this unhandled edge case to reparent a foreign report. This is the closest CAPEC; a more specific \u0027IDOR\u0027 or \u0027broken object reference\u0027 CAPEC does not exist in the CAPEC catalog, so CAPEC-174 is the best available match."
}
],
"commit": "43665b9bb6bd39af0db1f38e608bdf2cb84b9dec",
"confidence": "medium",
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 4.8"
},
{
"lang": "en",
"type": "reporter",
"value": "David Andr\u00e9"
},
{
"lang": "en",
"type": "reporter",
"value": "Jeroen Pinoy"
}
],
"cvssRationale": "AV:N: MISP is a network-accessible web application. AC:L: the attacker only needs to supply a known/guessed UUID in a standard edit request; no race or complex condition. AT:N: no manipulation of the target environment is required. PR:L: the attacker must be an authenticated user with editor role on at least one event. UI:N: no victim interaction is needed. VC:N/VI:N/VA:N: the MISP application itself (its configuration, credentials, availability) is not directly impacted. SC:H: the attacker gains read access to private report data in events they cannot otherwise see. SI:H: the attacker can overwrite and modify report data belonging to other events. SA:N: no safety-system impact.",
"fixSummary": "The fix adds an ownership check in editReport: before adopting an existing report found by UUID, the code now verifies that the report\u0027s event_id matches the event being edited. If the UUID resolves to a report belonging to a different event, the operation is rejected with an error message, preventing cross-event reparenting, unauthorized read, and unauthorized overwrite of reports.",
"generatedAt": "2026-09-21T13:01:16.364280Z",
"generator": "patch2vuln.py",
"model": "qwen3.8:27b",
"modelComparison": {
"rankings": [
{
"agreementScore": 9,
"assumptionCount": 5,
"confidence": "medium",
"model": "qwen3.8:27b",
"score": 5
}
],
"selectedModel": "qwen3.8:27b",
"selectionMethod": "deterministic-consensus-v1",
"selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
},
"patchSha256": "2306bd95d16b9c00582997897aa9181253364082a09589640fce576a03beafb4",
"patchSummary": "In app/Model/EventReport.php, the editReport method\u0027s else-branch (handling an existing report found by UUID) now includes an 11-line guard: it compares (string)$existingReport[\u0027EventReport\u0027][\u0027event_id\u0027] against (string)$eventId and, on mismatch, appends an error string and returns early, preventing the subsequent assignment of the foreign report\u0027s ID to the current event\u0027s report record.",
"patchTruncated": false,
"patches": [
{
"commit": "43665b9bb6bd39af0db1f38e608bdf2cb84b9dec",
"patchSha256": "2306bd95d16b9c00582997897aa9181253364082a09589640fce576a03beafb4",
"source": "https://github.com/MISP/MISP/commit/43665b9bb.patch",
"sourceUrl": "https://github.com/MISP/MISP/commit/43665b9bb.patch",
"subject": "fix: [security] Refuse to adopt an event report that belongs"
}
],
"source": "https://github.com/MISP/MISP/commit/43665b9bb.patch",
"subject": "fix: [security] Refuse to adopt an event report that belongs",
"tagVersionBoundary": {
"commits_after_fix": 56,
"repository": "https://github.com/MISP/MISP",
"tag": "v2.5.47",
"version": "2.5.47",
"version_type": "semver"
},
"weaknessRationale": [
{
"cweId": "CWE-639",
"rationale": "The report UUID is a user-controlled key resolved globally without scoping to the caller\u0027s event context. The system failed to verify that the referenced object (report) belongs to the event the caller is authorized to edit, allowing cross-event access."
},
{
"cweId": "CWE-284",
"rationale": "The broader category applies: MISP\u0027s per-event access control model was bypassed because the editReport path did not enforce that a report UUID maps to the same event the caller is operating on."
}
]
}
}
},
"recordType": "advisory",
"vulnId": "GCVE-1-2026-20057"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "00000000-0000-4000-9000-000000000000",
"cveId": "CVE-2026-94393",
"datePublished": "2026-09-21T13:13:46.709115Z",
"dateReserved": "2026-09-21T13:13:54.299Z",
"dateUpdated": "2026-09-21T13:13:54.565172Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1-2026-20057"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Mitigation MIT-1
Architecture and Design
Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Mitigation MIT-46
Architecture and Design
Strategy: Separation of Privilege
- Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
- Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
CAPEC-19: Embedding Scripts within Scripts
An adversary leverages the capability to execute their own script by embedding it within other scripts that the target software is likely to execute due to programs' vulnerabilities that are brought on by allowing remote hosts to execute scripts.
CAPEC-441: Malicious Logic Insertion
An adversary installs or adds malicious logic (also known as malware) into a seemingly benign component of a fielded system. This logic is often hidden from the user of the system and works behind the scenes to achieve negative impacts. With the proliferation of mass digital storage and inexpensive multimedia devices, Bluetooth and 802.11 support, new attack vectors for spreading malware are emerging for things we once thought of as innocuous greeting cards, picture frames, or digital projectors. This pattern of attack focuses on systems already fielded and used in operation as opposed to systems and their components that are still under development and part of the supply chain.
CAPEC-478: Modification of Windows Service Configuration
An adversary exploits a weakness in access control to modify the execution parameters of a Windows service. The goal of this attack is to execute a malicious binary in place of an existing service.
CAPEC-479: Malicious Root Certificate
An adversary exploits a weakness in authorization and installs a new root certificate on a compromised system. Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website. Adversaries have used this technique to avoid security warnings prompting users when compromised systems connect over HTTPS to adversary controlled web servers that spoof legitimate websites in order to collect login credentials.
CAPEC-502: Intent Spoof
An adversary, through a previously installed malicious application, issues an intent directed toward a specific trusted application's component in an attempt to achieve a variety of different objectives including modification of data, information disclosure, and data injection. Components that have been unintentionally exported and made public are subject to this type of an attack. If the component trusts the intent's action without verififcation, then the target application performs the functionality at the adversary's request, helping the adversary achieve the desired negative technical impact.
CAPEC-503: WebView Exposure
An adversary, through a malicious web page, accesses application specific functionality by leveraging interfaces registered through WebView's addJavascriptInterface API. Once an interface is registered to WebView through addJavascriptInterface, it becomes global and all pages loaded in the WebView can call this interface.
CAPEC-536: Data Injected During Configuration
An attacker with access to data files and processes on a victim's system injects malicious data into critical operational data during configuration or recalibration, causing the victim's system to perform in a suboptimal manner that benefits the adversary.
CAPEC-546: Incomplete Data Deletion in a Multi-Tenant Environment
An adversary obtains unauthorized information due to insecure or incomplete data deletion in a multi-tenant environment. If a cloud provider fails to completely delete storage and data from former cloud tenants' systems/resources, once these resources are allocated to new, potentially malicious tenants, the latter can probe the provided resources for sensitive information still there.
CAPEC-550: Install New Service
When an operating system starts, it also starts programs called services or daemons. Adversaries may install a new service which will be executed at startup (on a Windows system, by modifying the registry). The service name may be disguised by using a name from a related operating system or benign software. Services are usually run with elevated privileges.
CAPEC-551: Modify Existing Service
When an operating system starts, it also starts programs called services or daemons. Modifying existing services may break existing services or may enable services that are disabled/not commonly used.
CAPEC-552: Install Rootkit
An adversary exploits a weakness in authentication to install malware that alters the functionality and information provide by targeted operating system API calls. Often referred to as rootkits, it is often used to hide the presence of programs, files, network connections, services, drivers, and other system components.
CAPEC-556: Replace File Extension Handlers
When a file is opened, its file handler is checked to determine which program opens the file. File handlers are configuration properties of many operating systems. Applications can modify the file handler for a given file extension to call an arbitrary program when a file with the given extension is opened.
CAPEC-558: Replace Trusted Executable
An adversary exploits weaknesses in privilege management or access control to replace a trusted executable with a malicious version and enable the execution of malware when that trusted executable is called.
CAPEC-562: Modify Shared File
An adversary manipulates the files in a shared location by adding malicious programs, scripts, or exploit code to valid content. Once a user opens the shared content, the tainted content is executed.
CAPEC-563: Add Malicious File to Shared Webroot
An adversaries may add malicious content to a website through the open file share and then browse to that content with a web browser to cause the server to execute the content. The malicious content will typically run under the context and permissions of the web server process, often resulting in local system or administrative privileges depending on how the web server is configured.
CAPEC-564: Run Software at Logon
Operating system allows logon scripts to be run whenever a specific user or users logon to a system. If adversaries can access these scripts, they may insert additional code into the logon script. This code can allow them to maintain persistence or move laterally within an enclave because it is executed every time the affected user or users logon to a computer. Modifying logon scripts can effectively bypass workstation and enclave firewalls. Depending on the access configuration of the logon scripts, either local credentials or a remote administrative account may be necessary.
CAPEC-578: Disable Security Software
An adversary exploits a weakness in access control to disable security tools so that detection does not occur. This can take the form of killing processes, deleting registry keys so that tools do not start at run time, deleting log files, or other methods.