Is CVE-2026-64968 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-64968 being exploited in the wild.

How severe is CVE-2026-64968?

Informational severity, published 20 August 2026.

Which products and versions are affected?

ATutor 2.2.4 (confirmed); other versions likely affected.

Is there a fix for CVE-2026-64968?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-64968 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-64968?

Check whether you run ATutor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-64968: ATutor server-side request forgery in import functionality

CVE-2026-64968 · Severity: info · Published 2026-08-20

ATutor is a learning management system used to deliver and manage online courses. An authenticated administrator can exploit a server-side request forgery vulnerability in the import functionality to make the ATutor server send requests to internal HTTP endpoints, cloud metadata services, or local files via file:// protocol, potentially exposing sensitive internal data or credentials.

Technologies: ATutor. Vendors: ATutor.

Quick answers

Is CVE-2026-64968 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-64968 being exploited in the wild.
How severe is CVE-2026-64968?: Informational severity, published 20 August 2026.
Which products and versions are affected?: ATutor 2.2.4 (confirmed); other versions likely affected.
Is there a fix for CVE-2026-64968?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-64968 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-64968?: Check whether you run ATutor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a server-side request forgery (SSRF) vulnerability in ATutor's import functionalities. The vulnerability allows an authenticated administrator to inject arbitrary URLs (including internal HTTP endpoints, cloud metadata services, or file:// URIs if PHP environment permits URL wrappers) that the server will attempt to fetch. Attack requires admin-level authentication and knowledge of the import functionality endpoints. An attacker can retrieve sensitive data from internal services, query cloud metadata APIs (e.g., AWS metadata endpoint 169.254.169.254), or read local files. ATutor 2.2.4 is confirmed vulnerable; other versions untested but likely also affected. No patch is available as the product is no longer actively maintained.

Affected products

ATutor ATutor 2.2.4 (confirmed); other versions likely affected

Timeline

2026-08-20: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.