Is CVE-2026-85385 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-85385 being exploited in the wild.

How severe is CVE-2026-85385?

Critical severity, with a CVSS score of 9.6, published 16 September 2026.

Is there a fix for CVE-2026-85385?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-85385 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-85385?

Check whether you run Concrete CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85385: Concrete CMS stored XSS in user timezone field

CVE-2026-85385 · Severity: critical · CVSS 9.6 · Published 2026-09-16

Concrete CMS, a website content management system, failed to validate and safely display user-supplied timezone values in the Dashboard. An attacker could inject malicious scripts into the timezone field, which would execute in administrators' browsers when they viewed user accounts, potentially allowing the attacker to steal administrator credentials, create rogue admin accounts, or alter site settings without authorization.

Technologies: Concrete CMS. Vendors: Concrete CMS.

Quick answers

Is CVE-2026-85385 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-85385 being exploited in the wild.
How severe is CVE-2026-85385?: Critical severity, with a CVSS score of 9.6, published 16 September 2026.
Which products and versions are affected?: Concrete CMS below 9.5.4.
Is there a fix for CVE-2026-85385?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-85385 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-85385?: Check whether you run Concrete CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a stored cross-site scripting (XSS) vulnerability in the user timezone (uTimezone) field. The vulnerability exists because Concrete CMS did not validate the timezone value on input and did not output-encode it when rendering on the Dashboard user management page. The Date::getTimezoneDisplayName() function returns non-IANA timezone values unchanged, allowing arbitrary HTML/JavaScript to be stored and executed. In version 9.5.3 and below, authenticated users could exploit this via the account profile editor; in 9.5.3, the field became reachable to unauthenticated visitors through public registration. Exploitation requires the concrete.misc.user_timezones configuration to be enabled (off by default) and, for the unauthenticated attack path, requires public registration to be enabled. When an administrator views the affected user in the Dashboard, the stored payload executes in their session context, enabling admin-level compromise.

Affected products

Concrete CMS Concrete CMS below 9.5.4

Timeline

2026-09-16: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.