Is CVE-2026-44987 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44987 being exploited in the wild.

How severe is CVE-2026-44987?

Low severity, with a CVSS score of 3.8, published 8 May 2026.

Which products and versions are affected?

Syslifters SysReptor < 2026.29.

Is there a fix for CVE-2026-44987?

A patch was published on 2026-05-06: Issue patched in version 2026.29 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44987 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-44987?

Check whether you run Syslifters SysReptor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44987: Syslifters SysReptor privilege escalation in user management

Q: Is there a fix for CVE-2026-44987?

A patch was published on 2026-05-06: Issue patched in version 2026.29 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-44987 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-44987?

Check whether you run Syslifters SysReptor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44987 · Severity: low · CVSS 3.8 · Published 2026-05-08

SysReptor is a platform used by security teams to create and manage penetration testing reports. A vulnerability allows users with administrative access to change the email addresses of high-level 'Superusers,' potentially leading to full account takeover if password reset features are enabled. This could allow an attacker to access sensitive security findings across all projects or modify global system settings.

Technologies: Syslifters SysReptor. Vendors: Syslifters.

Quick answers

Is CVE-2026-44987 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44987 being exploited in the wild.
How severe is CVE-2026-44987?: Low severity, with a CVSS score of 3.8, published 8 May 2026.
Which products and versions are affected?: Syslifters SysReptor < 2026.29.
Is there a fix for CVE-2026-44987?: A patch was published on 2026-05-06: Issue patched in version 2026.29 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44987 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-44987?: Check whether you run Syslifters SysReptor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An improper privilege management vulnerability (CWE-269) exists in SysReptor's user management component. Users with 'User Admin' privileges can modify the email addresses associated with 'Superuser' accounts. If the optional 'Forgot Password' feature is enabled and the target Superuser does not have Multi-Factor Authentication (MFA) active, the User Admin can trigger a password reset to an email address they control. This grants the attacker access to the Django administration backend and the ability to escalate their own permissions to 'Project Admin' across all pentest projects. The issue is resolved in version 2026.29.

Affected products

Syslifters sysreptor < 2026.29

Timeline

2026-05-06: patched: Issue patched in version 2026.29
2026-05-08: disclosed: Public advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.