Quick answers
- Is CVE-2026-15580 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-15580 being exploited in the wild.
- How severe is CVE-2026-15580?
- Informational severity, published 21 August 2026.
- Which products and versions are affected?
- N-able PassPortal before 3.49.6.
- Is there a fix for CVE-2026-15580?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-15580 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-15580?
- Check whether you run N-able PassPortal at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a vault token disclosure issue arising from insufficient validation of postMessage communications in the PassPortal browser extension. An attacker can exploit unvalidated postMessage calls to intercept authentication tokens stored in the vault. The attack requires interaction with or hosting of a malicious webpage that the user visits while the extension is active. Successful exploitation allows token theft and subsequent authentication abuse to access protected resources. The issue affects PassPortal versions before 3.49.6 and is patched in that release.
Affected products
- N-able PassPortal before 3.49.6
Timeline
- 2026-08-21: disclosed