Is CVE-2026-24710 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-24710 being exploited in the wild.

How severe is CVE-2026-24710?

Medium severity, with a CVSS score of 6.1, published 14 May 2026.

Which products and versions are affected?

Northern.tech CFEngine Enterprise before 3.21.8, 3.24.3, 3.27.0.

Is there a fix for CVE-2026-24710?

A patch was published on 2026-02-09: Vendor released fix and advisory Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-24710 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-24710?

Check whether you run Northern.tech CFEngine Enterprise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-24710: Northern.tech CFEngine Enterprise Injection Vulnerabilities in Mission Portal

CVE-2026-24710 · Severity: medium · CVSS 6.1 · Published 2026-05-14

Northern.tech CFEngine Enterprise, a platform used for managing and automating IT infrastructure, is affected by multiple injection vulnerabilities in its Mission Portal interface. An authenticated attacker could use these flaws to execute malicious scripts in the browsers of other users, such as administrators, or potentially run unauthorized commands on the management hub. This could lead to unauthorized access to sensitive infrastructure data or a compromise of the management console.

Technologies: Northern.tech CFEngine Enterprise. Vendors: Northern.tech.

Quick answers

Is CVE-2026-24710 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-24710 being exploited in the wild.
How severe is CVE-2026-24710?: Medium severity, with a CVSS score of 6.1, published 14 May 2026.
Which products and versions are affected?: Northern.tech CFEngine Enterprise before 3.21.8, 3.24.3, 3.27.0.
Is there a fix for CVE-2026-24710?: A patch was published on 2026-02-09: Vendor released fix and advisory Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-24710 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-24710?: Check whether you run Northern.tech CFEngine Enterprise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists due to missing input sanitization and improper output escaping within the Mission Portal component of CFEngine Enterprise. An authenticated attacker with access to the web interface can inject malicious payloads (JavaScript, SQL, or shell commands) through user-input fields. While the primary classification is XSS, the vendor advisory indicates that the same lack of sanitization also allows for blind SQL injection and OS command injection on the hub. Exploitation requires the attacker to have an initial level of access (authenticated user) and, in the case of XSS, requires interaction from another user (e.g., an administrator visiting a compromised page). The issues are resolved in versions 3.21.8, 3.24.3, and 3.27.0.

Affected products

Northern.tech CFEngine Enterprise before 3.21.8, 3.24.3, 3.27.0

Timeline

2026-02-09: patched: Vendor released fix and advisory
2026-05-14: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.