CVE-2026-24710

MediumCVSS 6.1

Published: 14/05/2026(UTC)Updated: 19/10/2026(UTC)Translated: 20/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

6th percentile - higher than 6% of all known CVEs

Summary

Northern.tech CFEngine Enterprise before 3.21.8, 3.24.3, and 3.27.0 contains a cross-site scripting (XSS) vulnerability. The flaw allows injection of malicious script that may execute in a user's browser.

Risk Assessment

An attacker could exploit XSS to hijack user sessions, steal data, or perform unauthorized actions within the application context. Organizations running vulnerable CFEngine Enterprise versions are at risk.

Recommendation

Upgrade CFEngine Enterprise to version 3.21.8, 3.24.3, or 3.27.0 (or later). Verify that deployed instances are not exposed to XSS vectors.

Other vulnerabilities in CFEngine Enterprise

See all

Original NVD description (English source)

Northern.tech CFEngine Enterprise before 3.21.8, 3.24.3, and 3.27.0 allows XSS.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS