Is CVE-2026-61707 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-61707 being exploited in the wild.

How severe is CVE-2026-61707?

Critical severity, with a CVSS score of 9, published 29 October 2026.

Which products and versions are affected?

SOCFortress CoPilot before 0.1.76.

How is CVE-2026-61707 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-61707?

Check whether you run SOCFortress CoPilot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-61707: SOCFortress CoPilot stored template injection in report generation

CVE-2026-61707 · Severity: critical · CVSS 9 · Published 2026-10-29

SOCFortress CoPilot is a security operations management platform that generates incident reports for administrators and analysts. A vulnerability allows low-privilege users to upload malicious report templates that are executed without sandboxing when reports are generated, enabling remote code execution with root privileges. An attacker could read all incident data, SIEM records, and stored credentials across all tenants in the deployment.

Technologies: SOCFortress CoPilot. Vendors: SOCFortress.

Quick answers

Is CVE-2026-61707 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-61707 being exploited in the wild.
How severe is CVE-2026-61707?: Critical severity, with a CVSS score of 9, published 29 October 2026.
Which products and versions are affected?: SOCFortress CoPilot before 0.1.76.
Is there a fix for CVE-2026-61707?: Yes: fixed in 0.1.76. Until then: Restrict case-report template upload, list, download, and delete operations to admin/analyst roles only; validate template file content by magic bytes and extension rather than filename MIME type inference.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-29"},{"kind":"patched","at":"2026-06-23"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61707 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-61707?: Check whether you run SOCFortress CoPilot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 0.1.76

Restrict case-report template upload, list, download, and delete operations to admin/analyst roles only; validate template file content by magic bytes and extension rather than filename MIME type inference.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-29"},{"kind":"patched","at":"2026-06-23"}]

Technical details

The vulnerability is a stored server-side template injection in case-report template rendering. Low-privilege customer_user roles can upload templates to `/case-report-template/upload` with only filename-based MIME validation; these templates are later rendered by non-sandboxed Jinja2 engines in `reports.py` (DocxTemplate) and `reports_pdf.py` (Environment) when privileged admin/analyst users generate reports via `/api/incidents/report/generate-report-docx` or `/generate-report-pdf`. Jinja2 expressions in the template body execute as arbitrary Python code with the backend process privileges (root in the reported deployment). Additional vectors include deletion of default templates to force poisoning, local-file reads, and SSRF via the wkhtmltopdf renderer.

Affected products

SOCFortress CoPilot before 0.1.76

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.