Is CVE-2026-29597 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-29597 being exploited in the wild.

How severe is CVE-2026-29597?

Medium severity, with a CVSS score of 6.5, published 30 March 2026.

Which products and versions are affected?

DDSN Interactive Acora CMS 10.7.1.

Is there a fix for CVE-2026-29597?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-29597 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-29597?

Check whether you run DDSN Interactive Acora CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-29597: DDSN Interactive cm3 Acora CMS improper access control in file_details.asp

CVE-2026-29597 · Severity: medium · CVSS 6.5 · Published 2026-03-30

DDSN Interactive cm3 Acora CMS, a content management system used for website administration, contains a security flaw that allows users with basic 'editor' permissions to access restricted system files. By accessing a specific administrative page and changing file parameters, an attacker can steal sensitive information including administrator passwords, database credentials, and email server settings. This could lead to a total takeover of the website, unauthorized access to corporate email, and potential theft of customer data stored in the backend database.

Technologies: DDSN Interactive Acora CMS. Vendors: DDSN Interactive.

Quick answers

Is CVE-2026-29597 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-29597 being exploited in the wild.
How severe is CVE-2026-29597?: Medium severity, with a CVSS score of 6.5, published 30 March 2026.
Which products and versions are affected?: DDSN Interactive Acora CMS 10.7.1.
Is there a fix for CVE-2026-29597?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-29597 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-29597?: Check whether you run DDSN Interactive Acora CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An improper access control vulnerability exists in the '/Admin/file_manager/file_details.asp' endpoint of DDSN Interactive cm3 Acora CMS version 10.7.1. The flaw is triggered by manipulating the 'file' parameter via force browsing, which fails to properly validate the user's authorization level for specific system files. An authenticated attacker with 'editor' privileges can exploit this to read sensitive XML configuration files (such as cm3.xml). Successful exploitation allows the retrieval of plaintext system administrator credentials, SMTP settings, and database connection strings, facilitating full administrative takeover and lateral movement.

Affected products

DDSN Interactive cm3 Acora CMS 10.7.1

Timeline

2026-03-30: advisory: Initial disclosure of CVE-2026-29597

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.