Quick answers
- Is CVE-2026-80462 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-80462 being exploited in the wild.
- How severe is CVE-2026-80462?
- Critical severity, with a CVSS score of 10, published 11 September 2026.
- Which products and versions are affected?
- Progress Chef Automate <UNKNOWN>.
- Is there a fix for CVE-2026-80462?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-80462 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-80462?
- Check whether you run Progress Chef Automate at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is an authentication bypass vulnerability in the Chef Automate API gateway's identity validation logic. The flaw allows an unauthenticated actor to craft requests that bypass the authentication pathway and gain elevated privileges to protected API functionality. The vulnerability is network-reachable and requires no prior authentication or special privileges to exploit, though it may require specific conditions to be met. Successful exploitation grants attackers complete administrative access to Chef Automate, enabling them to modify configurations, execute arbitrary code on managed nodes, and compromise the entire infrastructure under management. A patch is expected to be available from Progress.
Affected products
- Progress Chef Automate <UNKNOWN>
Timeline
- 2026-09-11: disclosed
- 2026-08: advisory: Progress issued a critical security bulletin in August 2026