Is CVE-2026-42539 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42539 being exploited in the wild.

How severe is CVE-2026-42539?

Medium severity, with a CVSS score of 6.5, published 4 June 2026.

Is there a fix for CVE-2026-42539?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-42539 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-42539?

Check whether you run DFIR-IRIS Iris at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42539: DFIR-IRIS IRIS excessive data exposure in API responses

CVE-2026-42539 · Severity: medium · CVSS 6.5 · Published 2026-06-04

IRIS is a collaborative platform used by incident responders to manage and share technical details during security investigations. A vulnerability in the platform's API allows authenticated users to view sensitive information that should be hidden, such as password hashes, multi-factor authentication (MFA) secrets, and internal server file paths. This exposure could allow a malicious user to compromise other accounts or gain deeper access to the server hosting the platform.

Technologies: DFIR-IRIS Iris. Vendors: DFIR-IRIS.

Quick answers

Is CVE-2026-42539 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42539 being exploited in the wild.
How severe is CVE-2026-42539?: Medium severity, with a CVSS score of 6.5, published 4 June 2026.
Which products and versions are affected?: DFIR-IRIS Iris <= 2.4.27.
Is there a fix for CVE-2026-42539?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-42539 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-42539?: Check whether you run DFIR-IRIS Iris at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An excessive data exposure vulnerability (CWE-201) exists in the IRIS web application API. When certain objects are accessed or updated via the API, the server returns JSON responses containing sensitive fields that are not required for client-side operations. Specifically, the `/manage/users/update/` and `/user/update` endpoints leak bcrypt password hashes and MFA secrets, while the Datastore file update endpoint leaks full local server storage paths. An attacker with low-privileged network access can exploit this to obtain credentials or reconnaissance data. The issue is fixed in version 2.4.28 by filtering these fields from API responses.

Affected products

DFIR-IRIS IRIS <= 2.4.27

Timeline

2026-01-26: other: Vulnerability discovered by SBA Research
2026-05-19: disclosed: Public disclosure on oss-security mailing list
2026-05-28: advisory: GitHub Security Advisory published
2026-06-04: advisory: NVD record published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.