Is CVE-2026-61708 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-61708 being exploited in the wild.

How severe is CVE-2026-61708?

High severity, with a CVSS score of 8.5, published 30 October 2026.

Which products and versions are affected?

SOCFortress CoPilot prior to 0.1.76.

Is there a fix for CVE-2026-61708?

Yes: fixed in 0.1.76. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-61708 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-61708?

Check whether you run SOCFortress CoPilot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-61708: SOCFortress CoPilot authorization bypass in data store upload

CVE-2026-61708 · Severity: high · CVSS 8.5 · Published 2026-10-30

SOCFortress CoPilot is a security operations platform that centralizes threat monitoring and case management across multiple tenants. Prior to version 0.1.76, a low-privilege customer user could upload files to any tenant's storage buckets without validation, allowing them to overwrite critical files such as endpoint telemetry configurations, case evidence, and forensic artifacts belonging to other organizations. This could enable data tampering, blind security monitoring, corrupt investigations, or plant malicious data across the platform.

Technologies: SOCFortress CoPilot. Vendors: SOCFortress.

Quick answers

Is CVE-2026-61708 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-61708 being exploited in the wild.
How severe is CVE-2026-61708?: High severity, with a CVSS score of 8.5, published 30 October 2026.
Which products and versions are affected?: SOCFortress CoPilot prior to 0.1.76.
Is there a fix for CVE-2026-61708?: Yes: fixed in 0.1.76. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61708 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-61708?: Check whether you run SOCFortress CoPilot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 0.1.76

Technical details

The POST /api/agent_data_store/upload endpoint permitted customer_user-role callers to specify arbitrary bucket_name and object_name parameters without allowlist validation, tenant prefix checks, or content restrictions. The backend automatically created missing buckets and performed upsert operations, enabling cross-tenant object overwrite attacks against sysmon configurations, case evidence, forensic artifacts, and report templates. The fix restricts the endpoint to admin/analyst roles only.

Affected products

SOCFortress CoPilot prior to 0.1.76

Timeline

2026-10-30: disclosed: CVE-2026-61708 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.