CVE-2026-42539
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 return sensitive data to the user which are not required for the client’s operation. Version 2.4.28 contains a patch.
Risk Assessment
Unnecessary disclosure of sensitive data can lead to leakage of incident information or investigative data, compromising confidentiality.
Recommendation
Update IRIS to version 2.4.28 or later.
Other vulnerabilities in IRIS
See all- CVE-2026-18362Medium
The IRIS web application in version 2.4.26 and possibly others does not protect its user authentication against brute-force attacks.
- CVE-2026-18360High
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the custom attributes function.
- CVE-2026-16971Medium
The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks.
- CVE-2026-16970Medium
The IRIS web application in version 2.4.26 and possibly others contains a logout functionality which is ineffective. Stolen session cookies can therefore be misused for a long time.
- CVE-2026-16969High
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the assets function.
- CVE-2026-42547Medium
IRIS is a web collaborative platform that helps incident responders share technical details during investigations. In versions prior to 2.4.28, users can create alerts for customers that are not assigned to them. This can be abused to falsely attribute fake alerts to customers. In combination with Cross-Site Scripting, this can also be used to exfiltrate alerts from other customers. Version 2.4.28 contains a patch.
- CVE-2026-42543Medium
IRIS platform prior to version 2.4.28 is vulnerable to a CSRF attack because it uses the HTTP GET method to change server state. An attacker can exploit this to perform unauthorized actions on behalf of the victim.
- CVE-2026-42540Medium
IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 allow a user to alter values in the database via manipulated API requests.
- CVE-2026-42538Medium
IRIS is a web collaborative platform that helps incident responders share technical details. Versions prior to 2.4.28 do not properly validate uploaded files, allowing misuse for hosting phishing pages and introducing a Cross-Site Scripting (XSS) vulnerability.
- CVE-2026-42329Medium
Iris platform prior to version 2.4.28 contains a weakness that allows an attacker to redirect the user to a malicious website. This is an open redirect vulnerability.
Original NVD description (English source)
IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 return sensitive data to the user which are not required for the client’s operation. Version 2.4.28 contains a patch.