CVE-2026-24711
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
Northern.tech CFEngine Enterprise before 3.21.8, 3.24.3, and 3.27.0 has Incorrect Access Control.
Risk Assessment
Incorrect access control may allow unauthorized users to access functions or data they should not be permitted to reach.
Recommendation
Update CFEngine Enterprise to version 3.21.8, 3.24.3, 3.27.0 or later and review permission configuration.
Other vulnerabilities in CFEngine Enterprise
See all- CVE-2026-33553Medium
Northern.tech CFEngine Enterprise 3.24.3 before 3.24.4 and 3.27.0 before 3.27.1 allows XSS.
- CVE-2026-24710Medium
Northern.tech CFEngine Enterprise before 3.21.8, 3.24.3, and 3.27.0 contains a cross-site scripting (XSS) vulnerability. The flaw allows injection of malicious script that may execute in a user's browser.
Original NVD description (English source)
Northern.tech CFEngine Enterprise before 3.21.8, 3.24.3, and 3.27.0 has Incorrect Access Control.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS