PT-2026-46390 · Iris · Iris

Mkoppmann + 1 · CVE-2026-42543 · Published 2026-06-04 · Updated 2026-06-08

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions IRIS versions prior to 2.4.28

Description IRIS is a web collaborative platform designed for incident responders to share technical details during investigations. The software is susceptible to a cross-site request forgery attack, which occurs when an attacker tricks a user into performing actions they did not intend to do, because the application uses the GET HTTP method to change state on the server.

Recommendations Update to version 2.4.28.

Exploit

Fix

Weakness Enumeration

CWE-650

Related Identifiers

CVE-2026-42543

GHSA-M73W-V4R5-VW9M

Affected Products

Iris

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42543.json · Exploit
• 🔥 https://github.com/dfir-iris/iris-web/security/advisories/GHSA-m73w-v4r5-vw9m · Exploit
• https://osv.dev/vulnerability/CVE-2026-42543 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42543 · Security Note
• https://t.me/cveNotify/166579 · Telegram Post
• http://openwall.com/lists/oss-security/2026/05/19/11 · Note