PT-2026-40930

CVE-2026-24711

Published

2026-05-14

Updated

2026-05-19

Description by

CVSS 3.1

5.3

Medium

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions CFEngine Enterprise versions prior to 3.21.8 CFEngine Enterprise versions prior to 3.24.3 CFEngine Enterprise versions prior to 3.27.0

Description Incorrect access control allows cross-site scripting (XSS), a technique where malicious scripts are injected into otherwise trusted websites.

Recommendations Update to version 3.21.8. Update to version 3.24.3. Update to version 3.27.0.

Exploitability

Exploit

Fix

Impacts

Researchers

Tahmid Akbar Omim

Vendors

Affected products

Weakness enumeration

CWE-284: Improper Access Control

Related identifiers