PT-2026-26628 · Unknown · Precurio Intranet Portal

Indoushka · Publicado 2026-03-20 · Atualizado 2026-03-22 · CVE-2026-32989

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Precurio Intranet Portal version 4.4

Description Precurio Intranet Portal 4.4 contains a cross-site request forgery condition. Attackers can leverage this to compel authenticated users to submit malicious requests to a profile update endpoint that manages file uploads. Successful exploitation allows attackers to upload executable files to publicly accessible locations, potentially resulting in arbitrary code execution on the web server. The vulnerable endpoint handles file uploads during profile updates. The profile update endpoint is susceptible to crafted requests.

Recommendations Precurio Intranet Portal version 4.4: Implement same-site cookies and rotating tokens to prevent cross-site request forgery attacks.

Exploit

Correção

Unrestricted File Upload

CSRF

Enumeração de Fraquezas

CWE-434

CWE-352

Identificadores relacionados

CVE-2026-32989

Produtos afetados

Precurio Intranet Portal

Referências · 8

• 🔥 https://packetstorm.news/files/id/215644 · Exploit
• https://twitter.com/CveFindCom/status/2035034313331196400 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2035626970155782549 · Publicação no Twitter
• https://precurio.com · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-32989 · Nota de Segurança
• https://twitter.com/natalie_avfieb/status/2035115892317855898 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2035089137611809069 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2035105224537387073 · Publicação no Twitter