VulnerabilityAnalyzed

CVE-2026-35056

XenForo before 2.3.9 and before 2.2.18 allows remote code execution (RCE) by authenticated, but malicious, admin users.

HIGH 8.6EPSS 0.67%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.67%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

XenForo before 2.3.9 and before 2.2.18 allows remote code execution (RCE) by authenticated, but malicious, admin users. An attacker with admin panel access can execute arbitrary code on the server.

CVSS 4.0: 8.6 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.67% probability · 50th percentile
CISA KEV: Not listed
Weakness: CWE-94
Affected: xenforo/xenforo
Source: disclosure@vulncheck.com

References

https://www.vulncheck.com/advisories/xenforo-remote-code-execution-via-authenticated-adminThird Party Advisory
https://xenforo.com/community/threads/xenforo-2-3-9-inc-xfmg-2-2-18-released-security-fix.235659/Release Notes

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.