PT-2026-46391 · Iris · Iris

Mkoppmann + 1 · CVE-2026-42547 · Published 2026-06-04 · Updated 2026-06-04

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions IRIS versions prior to 2.4.28

Description Users can create alerts for customers not assigned to them, allowing for the false attribution of fake alerts. When combined with Cross-Site Scripting (XSS)—a technique where malicious scripts are injected into trusted websites—this flaw can be used to exfiltrate alerts belonging to other customers.

Recommendations Update to version 2.4.28.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-42547

GHSA-8HWQ-V6VM-9GRR

Affected Products

Iris

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42547.json · Exploit
• 🔥 https://github.com/dfir-iris/iris-web/security/advisories/GHSA-8hwq-v6vm-9grr · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-42547 · Security Note
• https://osv.dev/vulnerability/CVE-2026-42547 · Vendor Advisory
• http://openwall.com/lists/oss-security/2026/05/19/12 · Note