PT-2026-25359 · Fit2Cloud+2 · Jumpserver

Aradinbar · Publicado 2026-03-13 · Atualizado 2026-03-13 · CVE-2026-31798

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Média

Vetor base

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions JumpServer versions prior to 4.10.16-lts

Description JumpServer, an open source bastion host and operation and maintenance security audit system, does not properly validate certificates in the Custom SMS API Client. This allows an attacker to intercept requests and capture verification codes sent via the Custom SMS API before they reach the user’s phone.

Recommendations Update to version 4.10.16-lts or later.

Exploit

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2026-31798

GHSA-26PJ-MMXW-W3W7

Produtos afetados

Jumpserver

Referências · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31798.json · Exploit
• https://github.com/jumpserver/jumpserver/security/advisories/GHSA-26pj-mmxw-w3w7 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2032605891745259783 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-31798 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-31798 · Aviso do Fabricante