Is CVE-2026-24711 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-24711 being exploited in the wild.

How severe is CVE-2026-24711?

Medium severity, with a CVSS score of 5.3, published 14 May 2026.

Which products and versions are affected?

Northern.tech CFEngine Enterprise before 3.21.8, 3.24.3, 3.27.0, Before 3.21.8, 3.24.3, and 3.27.0.

Is there a fix for CVE-2026-24711?

A patch was published on 2026-02-09: Vendor blog post announcing fixes for multiple versions. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-24711 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-24711?

Check whether you run Northern.tech CFEngine Enterprise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-24711: Northern.tech CFEngine Enterprise privilege escalation in Mission Portal

CVE-2026-24711 · Severity: medium · CVSS 5.3 · Published 2026-05-14

Northern.tech CFEngine Enterprise, a platform used to manage and automate large-scale IT infrastructure, contains a security flaw in its Mission Portal management interface. An attacker with a low-privileged user account can bypass security controls to access restricted information or escalate their permissions to administrative levels. If successful, an attacker could gain full control over the management hub and all connected devices in the corporate infrastructure.

Technologies: Northern.tech CFEngine Enterprise. Vendors: Northern.tech.

Quick answers

Is CVE-2026-24711 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-24711 being exploited in the wild.
How severe is CVE-2026-24711?: Medium severity, with a CVSS score of 5.3, published 14 May 2026.
Which products and versions are affected?: Northern.tech CFEngine Enterprise before 3.21.8, 3.24.3, 3.27.0, Before 3.21.8, 3.24.3, and 3.27.0.
Is there a fix for CVE-2026-24711?: A patch was published on 2026-02-09: Vendor blog post announcing fixes for multiple versions. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-24711 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-24711?: Check whether you run Northern.tech CFEngine Enterprise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A broken access control vulnerability exists in the Mission Portal component of CFEngine Enterprise. The flaw allows an authenticated user with low-level privileges to bypass authorization checks. By exploiting this issue, an attacker can access sensitive information beyond their assigned scope or escalate their privileges to an administrative role. This escalation provides full control over the CFEngine hub, which can then be used to compromise the entire managed infrastructure. The vulnerability is addressed in versions 3.21.8, 3.24.3, and 3.27.0.

Affected products

Northern.tech CFEngine Enterprise before 3.21.8, 3.24.3, 3.27.0

Timeline

2026-02-09: patched: Vendor blog post announcing fixes for multiple versions.
2026-05-14: disclosed: CVE published to NVD.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.