Is CVE-2026-58476 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-58476 being exploited in the wild.

How severe is CVE-2026-58476?

High severity, with a CVSS score of 8.1, published 14 July 2026.

Which products and versions are affected?

Dan-in-CA Sustainable Irrigation Platform through 5.2.16.

Is there a fix for CVE-2026-58476?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-58476 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-58476?

Check whether you run Dan-in-CA Sustainable Irrigation Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-58476: Dan-in-CA Sustainable Irrigation Platform CSRF in administrative endpoints

CVE-2026-58476 · Severity: high · CVSS 8.1 · Published 2026-07-14

The Sustainable Irrigation Platform (SIP), a system used to manage automated irrigation, is vulnerable to an attack that could allow unauthorized users to take control of the device. By tricking a logged-in administrator into clicking a malicious link, an attacker can remotely reboot the device, delete irrigation programs, or install unauthorized software. This could lead to significant operational disruptions, such as crop damage due to failed irrigation or complete loss of device control.

Technologies: Dan-in-CA Sustainable Irrigation Platform. Vendors: Dan-in-CA.

Quick answers

Is CVE-2026-58476 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-58476 being exploited in the wild.
How severe is CVE-2026-58476?: High severity, with a CVSS score of 8.1, published 14 July 2026.
Which products and versions are affected?: Dan-in-CA Sustainable Irrigation Platform through 5.2.16.
Is there a fix for CVE-2026-58476?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-58476 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-58476?: Check whether you run Dan-in-CA Sustainable Irrigation Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Sustainable Irrigation Platform (SIP) through version 5.2.16. The application fails to implement CSRF token validation or origin verification for state-changing administrative actions performed via HTTP GET requests. An attacker can exploit this by luring an authenticated administrator to a malicious website that triggers these GET requests in the background. Impacted actions include disabling passphrases, rebooting the device, deleting programs, and installing plugins. Furthermore, the default configuration uses a known credential ('opendoor') and often lacks a required passphrase, increasing the risk of unauthorized access. No patch is currently specified in the advisory.

Affected products

Dan-in-CA SIP (Sustainable Irrigation Platform) through 5.2.16

Timeline

2026-07-14: advisory: Initial disclosure by VulnCheck and Zero Science Lab

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.