CVE-2026-33553
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
Northern.tech CFEngine Enterprise 3.24.3 before 3.24.4 and 3.27.0 before 3.27.1 allows XSS.
Risk Assessment
XSS attack could allow an attacker to execute malicious scripts in the victim's browser, potentially leading to session theft, defacement, or other actions within the application context.
Recommendation
Upgrade CFEngine Enterprise to version 3.24.4 or 3.27.1, which contain the patch.
Other vulnerabilities in CFEngine Enterprise
See all- CVE-2026-24711Medium
Northern.tech CFEngine Enterprise before 3.21.8, 3.24.3, and 3.27.0 has Incorrect Access Control.
- CVE-2026-24710Medium
Northern.tech CFEngine Enterprise before 3.21.8, 3.24.3, and 3.27.0 contains a cross-site scripting (XSS) vulnerability. The flaw allows injection of malicious script that may execute in a user's browser.
Original NVD description (English source)
Northern.tech CFEngine Enterprise 3.24.3 before 3.24.4 and 3.27.0 before 3.27.1 allows XSS.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS