Description Summary:
MISP contains a cross-site request forgery vulnerability in the sharing group quick-edit functionality, allowing unauthorized modification of sharing group memberships via crafted GET requests.

Executive Summary:
A high-severity cross-site request forgery vulnerability in MISP allows an attacker to manipulate sharing group memberships, potentially leading to unauthorized data access or disruption of information sharing.

Vulnerability Details

CVE-ID: CVE-2026-85546

Affected Software: MISP MISP

Affected Versions: 0 through 2.4.54

Vulnerability: This vulnerability occurs because HTTP method validation was omitted in the __initialiseSGQuickEdit() helper function. An attacker can use a crafted GET request to trigger state-changing actions, such as adding or removing organizations or servers from a sharing group, when performed by an authenticated user with sufficient privileges.

Business Impact

Successful exploitation allows an attacker to alter the distribution of sensitive intelligence by modifying sharing group membership. Given the CVSS score of 8.6, this flaw poses a significant risk to the integrity and confidentiality of shared information. Unauthorized changes to these groups can lead to data leaks or the intentional disruption of critical collaborative threat intelligence workflows.

Remediation Plan

Immediate Action: Upgrade to a version of MISP beyond 2.4.54 where the HTTP method enforcement is restored, or apply the upstream fix commit 3060d93cb.

Proactive Monitoring: Review web access logs for unusual GET requests targeting organization or server management endpoints, especially those originating from unexpected referrers.

Compensating Controls: Implement strict Web Application Firewall rules to block GET requests directed at administrative or management endpoints that perform state-changing operations.

Exploitation Status

Public Exploit Available: No — exploit_available is unknown.

Analyst Notes: As of September 5, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable if an attacker can trick an authenticated administrator into navigating to a malicious link.

Analyst Recommendation

The severity of this vulnerability necessitates immediate attention to prevent unauthorized administrative modifications within MISP. Organizations should verify their current version and apply the vendor-provided patch as soon as possible to ensure that sharing group configurations remain protected against CSRF-based manipulation.

Description Summary:
An incorrect authorization vulnerability in MISP allows authenticated users to delete event attributes without the required permissions by bypassing standard event modification checks.

Executive Summary:
A high-severity authorization bypass in MISP allows authenticated users to perform unauthorized deletions of threat intelligence data, risking the integrity of security operations.

Vulnerability Details

CVE-ID: CVE-2026-85538

Affected Software: MISP MISP

Affected Versions: 0 through 2.5.45

Vulnerability: The vulnerability is an incorrect authorization flaw (CWE-863) within the MispAttribute::deleteAttribute function. Authenticated users belonging to an organization can bypass event modification rules to delete attributes even if their assigned role lacks the necessary permissions to modify that specific event.

Business Impact

The ability for unauthorized users to delete attributes from threat intelligence events poses a significant risk to organizational security posture. Because MISP is often the central repository for critical indicators of compromise, successful exploitation could lead to the loss of vital threat data, hindering incident response efforts and potentially allowing malicious activity to go undetected. With a CVSS score of 8.3, this flaw is categorized as high severity due to the high impact on data integrity and the relative ease of exploitation for existing platform users.

Remediation Plan

Immediate Action: Administrators must update MISP to a version beyond 2.5.45 that incorporates the corrected authorization logic provided in the vendor patch.

Proactive Monitoring: Security teams should review MISP audit logs for anomalous bulk attribute deletions or deletions performed by accounts that typically do not possess event modification privileges.

Compensating Controls: While no direct WAF rule can fix an internal logic flaw, organizations should enforce strict role-based access control (RBAC) and limit the number of users with elevated privileges until the patch is applied.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of September 5, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is an internal logic error that requires an authenticated session, limiting the attack surface to existing platform members.

Analyst Recommendation

This vulnerability represents a significant risk to the reliability of threat intelligence workflows. Administrators are urged to prioritize the update to the latest patched version of MISP to ensure that event modification authorization checks are consistently enforced across all deletion paths. Failure to patch may result in unauthorized data loss that could compromise the effectiveness of the entire security operations center.

Description Summary:
A lack of brute-force protection in MISP's email-based OTP authentication flow allows authenticated users to bypass multi-factor authentication via excessive verification attempts.

Executive Summary:
A vulnerability in the MISP email-based OTP authentication flow allows an attacker with primary credentials to bypass multi-factor authentication, posing a high risk of unauthorized account access.

Vulnerability Details

CVE-ID: CVE-2026-85237

Affected Software: MISP MISP

Affected Versions: 0 through 2.5.45

Vulnerability: This vulnerability involves an improper restriction of excessive authentication attempts (CWE-307) within the email_otp() endpoint, which lacks rate limiting for OTP verification. An attacker who has already obtained a user's primary credentials can perform an unrestricted number of guesses to bypass the second authentication factor.

Business Impact

Successful exploitation of this flaw allows unauthorized actors to bypass multi-factor authentication, leading to full account compromise. Given the CVSS score of 8.6, this represents a high-severity risk to the confidentiality and integrity of sensitive intelligence data managed within MISP. Unauthorized access could result in the exfiltration of classified threat information or the manipulation of intelligence feeds, causing significant reputational and operational damage.

Remediation Plan

Immediate Action: Update MISP to the latest version that integrates brute-force protection into the email OTP flow, as identified in the vendor security advisory.

Proactive Monitoring: Review authentication and access logs for patterns indicative of brute-force attempts, such as high frequencies of failed OTP requests originating from a single user account.

Compensating Controls: Ensure that account lockout policies are strictly enforced at the identity provider level and monitor for concurrent login sessions that deviate from established user behavior baselines.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of September 4, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable by any actor who has already obtained the victim's primary password, making it a critical threat to multi-factor security.

Analyst Recommendation

This vulnerability presents a significant risk to the integrity of authentication within the MISP platform. Administrators must prioritize updating the software to the version containing the integrated brute-force protection mechanisms. Failure to remediate this flaw leaves accounts vulnerable to credential-based attacks that bypass secondary security layers, potentially exposing sensitive intelligence assets to unauthorized parties.

Description Summary:
A CSRF vulnerability in the MISP cullEmptyEvents action allows remote attackers to trigger the unauthorized, irreversible deletion of published empty event records via a crafted HTTP GET request.

Executive Summary:
An authenticated session CSRF vulnerability in MISP versions 2.5.45 and earlier allows unauthorized deletion of event data, posing a significant risk to data integrity.

Vulnerability Details

CVE-ID: CVE-2026-85236

Affected Software: MISP MISP

Affected Versions: 0 through 2.5.45

Vulnerability: The application incorrectly exposes the cullEmptyEvents function to HTTP GET requests, which bypasses CakePHP's CSRF protection mechanisms. An attacker can trick an authenticated user into visiting a malicious URL, causing the server to execute an irreversible deletion of published empty events.

Business Impact

The exploitation of this vulnerability results in the permanent loss of threat intelligence data, which can severely disrupt security operations and incident response workflows. Given the CVSS score of 8.8, this flaw is categorized as High severity: the ability to trigger irreversible data loss without user consent creates significant operational risk and potential loss of historical investigative records.

Remediation Plan

Immediate Action: Upgrade to a patched version of MISP that enforces HTTP POST requests for the cullEmptyEvents action, as identified in the vendor repository.

Proactive Monitoring: Review web access logs for unusual patterns of GET requests directed at the cullEmptyEvents endpoint, particularly those originating from unexpected referrers or external sources.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block or flag GET requests that attempt to access administrative or state-changing endpoints within the MISP interface.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of September 4, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous because it leverages the trust relationship between the user's browser and the application to bypass intended security controls.

Analyst Recommendation

Given the potential for irreversible data loss, organizations using MISP should prioritize applying the vendor provided security updates immediately. Administrators must verify that their installation is updated beyond version 2.5.45 to ensure that the cullEmptyEvents functionality is correctly restricted to POST requests, thereby restoring necessary CSRF protections.

Description Summary:
MISP contains an authentication bypass vulnerability in its LDAP and LinOTP components, allowing remote unauthenticated attackers to impersonate users via empty or invalid credential submissions.

Executive Summary:
A critical authentication bypass vulnerability in MISP allows unauthenticated remote attackers to impersonate privileged users, potentially leading to full compromise of sensitive threat intelligence data.

Vulnerability Details

CVE-ID: CVE-2026-85216

Affected Software: MISP MISP

Affected Versions: 0 through 2.5.45

Vulnerability: The vulnerability exists within the custom LdapAuthenticate and LinOTPAuthenticate components, which fail to properly validate user credentials. An unauthenticated attacker can supply empty passwords to trigger successful authentication against LDAP servers or local fallback mechanisms, effectively bypassing standard security controls.

Business Impact

Successful exploitation grants an attacker full access to the MISP platform with the privileges of the targeted account. Given the nature of MISP as a repository for sensitive threat intelligence, this could result in unauthorized data exfiltration, the injection of malicious indicators, or the total compromise of the platform's integrity. With a CVSS score of 9.5, this vulnerability represents an extreme risk to organizational security operations.

Remediation Plan

Immediate Action: Upgrade MISP to the latest patched version immediately to ensure that credential validation logic is correctly enforced.

Proactive Monitoring: Review application access logs for anomalous authentication patterns, specifically looking for successful logins that lack corresponding password submission data.

Compensating Controls: If an immediate upgrade is not feasible, ensure that backend LDAP servers are configured to reject unauthenticated binds and disable mixed authentication modes if possible.

Exploitation Status

Public Exploit Available: No (exploit_available: false).

Analyst Notes: As of Sep 3, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable due to the lack of required user interaction and the reliance on insecure default authentication behaviors.

Analyst Recommendation

This vulnerability presents a severe risk to any organization utilizing MISP for threat intelligence management. Administrators must prioritize the application of the vendor-provided patch, as the ability for an unauthenticated user to impersonate an administrator constitutes a critical security failure. Ensure that all authentication components are validated against the latest software release to prevent unauthorized system access.

Description Summary:
A denial-of-service vulnerability in misp-stix allows unauthenticated attackers to cause uncontrolled resource consumption by submitting malicious STIX 1 or STIX 2 documents.

Executive Summary:
A high-severity denial-of-service vulnerability in misp-stix enables unauthenticated attackers to crash the service via malicious STIX document processing.

Vulnerability Details

CVE-ID: CVE-2026-77755

Affected Software: MISP misp-stix

Affected Versions: 0 through 2026.7.8

Vulnerability: This vulnerability is classified as an uncontrolled resource consumption flaw (CWE-400). It occurs during the parsing of STIX documents, allowing an unauthenticated remote attacker to trigger excessive resource usage, leading to service disruption.

Business Impact

The CVSS score of 8.7 highlights a significant risk to service availability. Successful exploitation could render the MISP platform inaccessible, interrupting critical threat intelligence sharing and operational security workflows.

Remediation Plan

Immediate Action: Update the misp-stix component to a version beyond 2026.7.8, as specified in the vendor repository.

Proactive Monitoring: Monitor system resource usage, specifically CPU and memory spikes, during STIX file ingestion processes.

Compensating Controls: Implement strict input validation or size limits on incoming STIX documents at the edge of the network or via a Web Application Firewall (WAF) if immediate patching is not possible.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its remote, unauthenticated exploitability.

Analyst Recommendation

The vulnerability presents a clear risk to operational continuity. Administrators should verify their current version of misp-stix and apply the available security updates immediately to prevent potential service degradation.

Description Summary:
A path traversal vulnerability in the misp-stix library allows attackers to manipulate file paths during STIX 2 import and export operations.

Executive Summary:
A path traversal vulnerability in the misp-stix library could allow unauthenticated attackers to access sensitive files on the host system.

Vulnerability Details

CVE-ID: CVE-2026-77751

Affected Software: MISP misp-stix

Affected Versions: 0 through 2026.7.8

Vulnerability: This is a path traversal vulnerability (CWE-22) occurring during the handling of MISP object template names. The vulnerability is exploitable by unauthenticated remote attackers who can influence the input processed by the library.

Business Impact

Successful exploitation allows an attacker to read sensitive files outside of the intended directory, potentially leading to the exposure of configuration files, credentials, or system data. With a CVSS score of 8.8, this vulnerability represents a high risk to the confidentiality of the environment, as it grants unauthorized access to system resources.

Remediation Plan

Immediate Action: Upgrade the misp-stix package to a version beyond 2026.7.8, utilizing the fixes provided in the upstream commits a8b6808d and a0f54070.

Proactive Monitoring: Review application logs for suspicious path patterns or directory traversal attempts (e.g., sequences like ../) within inputs related to STIX 2 imports.

Compensating Controls: Implement strict input validation or use a Web Application Firewall to filter requests containing directory traversal characters before they reach the application.

Exploitation Status

Public Exploit Available: No (no confirmed public exploit in available data)

Analyst Notes: As of August 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While exploitation requires no authentication, the risk is mitigated by the specific context in which the library is invoked.

Analyst Recommendation

Given the high CVSS score and the potential for unauthorized file access, organizations should prioritize updating the misp-stix library immediately. Ensure that all downstream applications utilizing this package are tested after the update to maintain system integrity.

Description Summary:
The cti-transmute tool by MISP is vulnerable to Server-Side Request Forgery (SSRF) in its /fetch_misp_event and /misp_search_events endpoints.

Executive Summary:
A high-severity Server-Side Request Forgery (SSRF) vulnerability in cti-transmute allows unauthenticated attackers to potentially access internal resources and sensitive data.

Vulnerability Details

CVE-ID: CVE-2026-73160

Affected Software: MISP cti-transmute

Affected Versions: 0 through 1.4.0

Vulnerability: This SSRF vulnerability (CWE-918) exists within the /fetch_misp_event and /misp_search_events endpoints, allowing an unauthenticated attacker to force the application to make unauthorized requests to internal or external systems.

Business Impact

An attacker can exploit this vulnerability to perform reconnaissance on internal networks, bypass firewall protections, or interact with services that are not exposed to the public internet. Given the CVSS score of 8.7, this issue poses a significant risk of internal network compromise and unauthorized information disclosure.

Remediation Plan

Immediate Action: Review the official MISP repository for security updates, as a patch is required to restrict the allowed targets of the affected endpoints.

Proactive Monitoring: Monitor network logs for unusual outbound requests originating from the server hosting cti-transmute, specifically targeting internal IP ranges or sensitive metadata services.

Compensating Controls: Implement strict network egress filtering on the host running cti-transmute to prevent it from reaching internal network segments or unauthorized external endpoints.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The inherent nature of SSRF makes this a high-value target for attackers looking to pivot into internal network segments.

Analyst Recommendation

Due to the high severity and the unauthenticated nature of this SSRF vulnerability, organizations should prioritize restricting network access to the affected service until a vendor-supplied patch is applied. Monitor the MISP project documentation for release updates to address this flaw.

Description Summary:
CTI-Transmute is vulnerable to a cross-site request forgery attack within the administrative user deletion functionality, potentially allowing unauthorized account removal.

Executive Summary:
A cross-site request forgery vulnerability in MISP cti-transmute allows an attacker to trigger unauthorized administrative user deletion, posing a significant risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-69082

Affected Software: MISP cti-transmute

Affected Versions: 0 through 1.4.0

Vulnerability: The application is susceptible to a Cross-Site Request Forgery (CSRF) attack in the administrative user deletion function. This vulnerability is exploitable by an unauthenticated attacker, as indicated by the CVSS vector.

Business Impact

The ability for an attacker to delete administrative users can lead to a complete loss of administrative control over the application. Given the CVSS score of 8.8, this vulnerability is classified as high severity, as it can cause significant operational disruption and unauthorized access to system management functions.

Remediation Plan

Immediate Action: Review the project repository for available security patches or updates beyond version 1.4.0 and apply them immediately.

Proactive Monitoring: Monitor server access logs for suspicious requests directed at user management endpoints that do not originate from legitimate administrative sessions.

Compensating Controls: Implement a Web Application Firewall (WAF) with robust CSRF protection rules to inspect and filter malicious requests targeting administrative functions.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 4, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its potential to disrupt administrative access via simple automated requests.

Analyst Recommendation

The high CVSS score reflects the critical nature of maintaining administrative integrity. Organizations should prioritize updating their installation to a version where this CSRF vulnerability is remediated to prevent unauthorized account management actions.

Description Summary:
CTI-Transmute is vulnerable to an uncontrolled resource consumption attack at the unauthenticated activity_timeline endpoint, which could lead to a denial of service.

Executive Summary:
An unauthenticated resource consumption vulnerability in the MISP cti-transmute activity_timeline endpoint poses a risk of service disruption through excessive resource exhaustion.

Vulnerability Details

CVE-ID: CVE-2026-69079

Affected Software: MISP cti-transmute

Affected Versions: 0 through 1.4.0

Vulnerability: The application lacks necessary limits or throttling on the /activity_timeline endpoint, allowing an unauthenticated attacker to exhaust system resources. This is categorized as a resource consumption vulnerability under CWE-770.

Business Impact

Exploitation of this vulnerability could cause the application to become unresponsive, leading to significant system downtime and denial of service for legitimate users. With a CVSS score of 8.7, the impact on business continuity is severe, especially for organizations that rely on the availability of the CTI-Transmute service.

Remediation Plan

Immediate Action: Apply the latest security updates provided by the vendor to implement proper rate limiting and resource controls.

Proactive Monitoring: Monitor system resource usage, specifically CPU and memory consumption, for spikes related to requests targeting the activity_timeline endpoint.

Compensating Controls: Use a rate-limiting policy at the load balancer or reverse proxy level to restrict the number of requests per IP address to the affected endpoint.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 4, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The lack of resource throttling makes the endpoint inherently susceptible to automated abuse.

Analyst Recommendation

Service availability is a critical component of security. It is highly recommended that administrators apply available patches to enforce rate limiting and prevent the potential for denial of service attacks against the application.

Description Summary:
A server-side request forgery (SSRF) vulnerability exists in the PDF-generation functionality of the MISP cti-transmute tool, potentially allowing unauthorized data access.

Executive Summary:
A server-side request forgery vulnerability in MISP cti-transmute allows unauthenticated attackers to interact with internal network resources.

Vulnerability Details

CVE-ID: CVE-2026-69078

Affected Software: MISP cti-transmute

Affected Versions: 0 through 1.4.0

Vulnerability: This is a server-side request forgery vulnerability (CWE-918) within the evaluation report PDF-generation process. The vulnerability does not require authentication, allowing an attacker to force the server to make unauthorized requests.

Business Impact

Successful exploitation allows an attacker to bypass firewalls and interact with internal network services that are otherwise inaccessible from the internet. This can lead to the exposure of sensitive internal data, service enumeration, or potential interaction with vulnerable internal APIs. Given the CVSS score of 8.8, this represents a significant risk to the internal security posture of the host network.

Remediation Plan

Immediate Action: Update the cti-transmute tool to the latest version, ensuring that the fix provided in commit 20f35307bcb706c8dd8ca3884a88fb36b05b5244 is included.

Proactive Monitoring: Monitor egress traffic from the server running cti-transmute for suspicious or unexpected outbound requests to internal network segments.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter and block malicious requests that attempt to exploit the PDF-generation endpoint.

Exploitation Status

Public Exploit Available: No (no confirmed weaponized exploit or Metasploit/ExploitDB entry identified).

Analyst Notes: As of August 4, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly accessible as it does not require authentication to trigger the SSRF condition.

Analyst Recommendation

Due to the unauthenticated nature and high CVSS score, this vulnerability should be treated with high urgency. Organizations using MISP cti-transmute should verify their current version and apply the upstream fix immediately. Until the patch is applied, ensure the application is restricted from reaching sensitive internal network resources.

Description Summary:
A Server-Side Request Forgery (SSRF) protection bypass exists in the html_to_markdown expansion module of misp-modules, allowing authenticated users to perform unauthorized network requests.

Executive Summary:
An SSRF vulnerability in the misp-modules expansion component allows authenticated attackers to bypass security controls and potentially probe internal network resources.

Vulnerability Details

CVE-ID: CVE-2026-62143

Affected Software: MISP misp-modules

Affected Versions: 0 through v3.0.8

Vulnerability: This is a Server-Side Request Forgery (SSRF) vulnerability (CWE-918) within the html_to_markdown module. The application fails to adequately sanitize input, allowing an authenticated user with low privileges to force the server to make unauthorized requests to internal or external infrastructure.

Business Impact

With a CVSS score of 8.3, this flaw enables attackers to bypass network perimeters, potentially exposing sensitive internal services or data that are not intended for public access. In a security platform like MISP, this could lead to the exposure of threat intelligence feeds or internal API credentials.

Remediation Plan

Immediate Action: Upgrade misp-modules to a version beyond v3.0.8 or apply the fix provided in the referenced GitHub commit (3bae4108a3ba1e507727d5264697fd7303ba0b89).

Proactive Monitoring: Audit application logs for unusual outbound connection requests originating from the MISP server, particularly those targeting internal IP ranges.

Compensating Controls: Implement strict egress filtering on the MISP server to prevent it from initiating connections to unauthorized internal or sensitive external endpoints.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is technically straightforward to exploit once an attacker has authenticated access to the MISP instance.

Analyst Recommendation

Administrators must prioritize this update as it involves the core threat-sharing infrastructure. Ensure that all module dependencies are updated and verify the integrity of the html_to_markdown module configuration post-patch.

Description Summary:
An authenticated MISP administrator can trigger arbitrary code execution by providing a malicious configuration file path for the Kafka_rdkafka_config setting.

Executive Summary:
An authenticated administrative vulnerability in MISP allows for arbitrary code execution through the manipulation of Kafka configuration file paths.

Vulnerability Details

CVE-ID: CVE-2026-56447

Affected Software: MISP

Affected Versions: See vendor advisory

Vulnerability: This vulnerability occurs because the MISP application fails to properly sanitize the Kafka_rdkafka_config setting. An authenticated site administrator can supply an arbitrary path to a malicious INI file, which is then parsed by rdkafka, leading to the execution of arbitrary code.

Business Impact

With a CVSS score of 9.3, this flaw enables a malicious or compromised administrator to achieve full system control. The ability to execute arbitrary code with the privileges of the MISP process could lead to total data loss, unauthorized access to threat intelligence, and the compromise of connected security systems.

Remediation Plan

Immediate Action: Update MISP to the latest version, which restricts configuration settings to approved directories, and ensure that filesystem permissions are tightly controlled.

Proactive Monitoring: Monitor server logs for unauthorized modifications to configuration files or anomalous processes initiated by the MISP user account.

Compensating Controls: Ensure that the MISP webroot and upload directories are non-executable and reside on a read-only filesystem where possible to prevent the hosting of malicious configuration files.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

While this vulnerability requires administrative access, the risk of privilege escalation and full system compromise is extreme. Organizations should patch immediately and strictly enforce the principle of least privilege for all administrative accounts within the MISP platform.

Description Summary:
The Azure Active Directory (AAD) authentication plugin for MISP contains multiple OAuth 2.0 implementation flaws, including session token leakage and missing HTTPS enforcement.

Executive Summary:
Critical weaknesses in the MISP AAD authentication plugin expose users to session hijacking, session fixation, and credential theft due to improper OAuth 2.0 implementation.

Vulnerability Details

CVE-ID: CVE-2026-56425

Affected Software: MISP AAD Authentication Plugin

Affected Versions: See vendor advisory

Vulnerability: The authentication flow suffers from multiple failures: using insecure session identifiers as OAuth state, failing to regenerate session IDs, lacking HTTPS enforcement on redirect URIs, and improper logging of parameters. These issues collectively allow for session hijacking, CSRF, and credential exposure.

Business Impact

With a CVSS score of 9.3, this flaw poses a severe risk of unauthorized account access. An attacker could intercept sensitive authentication tokens or hijack active user sessions, leading to full unauthorized access to the MISP platform and the sensitive intelligence data contained within.

Remediation Plan

Immediate Action: Update the MISP AAD Authentication plugin to the latest version to enable cryptographically random state values, session rotation, and mandatory HTTPS enforcement.

Proactive Monitoring: Audit authentication logs for anomalous patterns, such as multiple sessions originating from different IPs or suspicious OAuth error responses.

Compensating Controls: Force all traffic through a secure Load Balancer or WAF that mandates HTTPS and inspects incoming authentication requests for anomalous parameters.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jun 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability fundamentally breaks the security model of the AAD authentication integration. Administrators must apply the provided updates immediately to prevent attackers from bypassing authentication controls and gaining unauthorized access to the system.

Description Summary:
MISP Core contains broken access-control checks in bulk deletion flows for Event Reports and Sharing Groups, allowing unauthorized deletion of data across an instance.

Executive Summary:
A critical access control vulnerability in MISP allows authenticated users with broad role permissions to delete critical data belonging to other organizations.

Vulnerability Details

CVE-ID: CVE-2026-56423

Affected Software: MISP MISP

Affected Versions: See vendor advisory

Vulnerability: The application relies on global permissions rather than per-object authorization checks in bulk deletion handlers, allowing authenticated contributors to delete Event Reports and Sharing Groups belonging to other organizations.

Business Impact

Successful exploitation allows for the catastrophic loss of intelligence data and configuration across a MISP instance. By bypassing ownership gates, an attacker can disrupt threat intelligence sharing activities, leading to data loss and the compromise of collaborative security efforts. The CVSS score of 9.4 reflects the high impact on data availability and integrity.

Remediation Plan

Immediate Action: Update MISP to the latest version, which implements mandatory per-object authorization checks (e.g., fetchIfAuthorized and checkIfOwner) for bulk deletions.

Proactive Monitoring: Review audit logs for bulk deletion events and compare the user performing the action against the ownership of the deleted objects.

Compensating Controls: Implement strict role-based access control (RBAC) policies and limit the number of users granted broad "add" or "sharing group" permissions until the patch is applied.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jun 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, the ability to perform mass data destruction makes this a high-priority risk for threat intelligence platforms.

Analyst Recommendation

This vulnerability undermines the trust model of the MISP platform. Organizations must prioritize the update to ensure that granular access controls are enforced, preventing unauthorized users from impacting the integrity of shared threat intelligence.

Description Summary:
MISP core controllers fail to properly validate ownership and primary keys, allowing authenticated users to perform unauthorized data modifications on objects they do not own.

Executive Summary:
A critical authorization flaw in MISP allows authenticated users to manipulate and overwrite unauthorized data, potentially compromising the integrity of sensitive threat intelligence.

Vulnerability Details

CVE-ID: CVE-2026-56422

Affected Software: MISP MISP

Affected Versions: See vendor advisory

Vulnerability: The vulnerability exists in the core CRUD components where client-controlled request fields, such as primary keys, are not properly re-pinned or validated against authorized objects. An authenticated attacker can manipulate REST/form payloads to perform unauthorized object overwrites, re-parenting, or ownership transfers.

Business Impact

With a CVSS score of 9.4, this vulnerability represents a severe threat to data integrity. Unauthorized modification of threat intelligence objects can lead to the corruption of security feeds, the redirection of sensitive events, or the injection of malicious content into shared threat intelligence databases, significantly undermining the trust and utility of the MISP platform.

Remediation Plan

Immediate Action: Update the MISP instance to the latest version provided by the vendor to implement the CRUDComponent::edit() primary-key re-pinning and field validation fixes.

Proactive Monitoring: Review audit logs for suspicious object modification activity, specifically looking for unexpected changes in ownership fields or unauthorized updates to primary keys.

Compensating Controls: Restrict API access to trusted users and implement strict network segmentation to limit the potential impact of an account compromise.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jun 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams must treat this authorization bypass as a high-priority update. The vulnerability allows for significant data manipulation that could persist undetected, making immediate patching essential to maintain the integrity of intelligence sharing workflows.