PT-2026-25359 · Fit2Cloud+2 · Jumpserver

Aradinbar · Published 2026-03-13 · Updated 2026-03-13 · CVE-2026-31798

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions JumpServer versions prior to 4.10.16-lts

Description JumpServer, an open source bastion host and operation and maintenance security audit system, does not properly validate certificates in the Custom SMS API Client. This allows an attacker to intercept requests and capture verification codes sent via the Custom SMS API before they reach the user’s phone.

Recommendations Update to version 4.10.16-lts or later.

Exploit

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2026-31798

GHSA-26PJ-MMXW-W3W7

Affected Products

Jumpserver

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31798.json · Exploit
• https://github.com/jumpserver/jumpserver/security/advisories/GHSA-26pj-mmxw-w3w7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31798 · Security Note
• https://osv.dev/vulnerability/CVE-2026-31798 · Vendor Advisory
• https://twitter.com/CVEnew/status/2032605891745259783 · Twitter Post