Quick answers
- Is CVE-2026-78276 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-78276 being exploited in the wild.
- How severe is CVE-2026-78276?
- High severity, with a CVSS score of 7.2, published 27 August 2026.
- Which products and versions are affected?
- ManageNinja LLC Fluent Boards Pro <= 2.0.11.
- Is there a fix for CVE-2026-78276?
- A patch was published on 2026-08-26: Fixed in version 2.0.12 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-78276 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-78276?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a PHP object injection flaw in Fluent Boards Pro versions up to 2.0.11, classified as an OWASP A3 Injection issue. The vulnerability requires the Editor privilege level to exploit, allowing attackers to manipulate how the site processes serialized data to execute arbitrary actions on the server. An attacker with editor privileges (or those who can bypass authentication to reach the editor) can instantiate malicious PHP objects and trigger remote code execution. The vulnerability has been patched in version 2.0.12 and later. Patchstack has released a mitigation rule to block attack attempts until sites are updated.
Affected products
- ManageNinja LLC Fluent Boards Pro <= 2.0.11
Timeline
- 2026-08-26: disclosed
- 2026-08-26: patched: Fixed in version 2.0.12