Quick answers
- Is CVE-2026-54220 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-54220 being exploited in the wild.
- How severe is CVE-2026-54220?
- Informational severity, with a CVSS score of 8.6, published 18 June 2026.
- Which products and versions are affected?
- UBB Systems UBB.threads All through 7.7.5.
- Is there a fix for CVE-2026-54220?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-54220 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-54220?
- Check whether you run UBB Systems UBB.threads at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
UBB.threads through version 7.7.5 is vulnerable to Cross-Site Request Forgery (CSRF) because the application lacks anti-CSRF tokens or other protective mechanisms for sensitive state-changing operations. An unauthenticated remote attacker can exploit this by crafting a malicious web page or link and tricking an authenticated user into interacting with it. If successful, the attacker can execute actions in the context of the victim's session, potentially leading to full account compromise or administrative configuration changes. As vendor contact attempts were unsuccessful, no official patch is currently available.
Affected products
- UBB Systems UBB.threads All through 7.7.5
Timeline
- 2026-06-18: disclosed: Vulnerability disclosed by CERT Polska after unsuccessful vendor contact attempts.
- 2026-06-18: advisory