Is CVE-2026-86347 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86347 being exploited in the wild.

How severe is CVE-2026-86347?

Medium severity, with a CVSS score of 6.5, published 7 September 2026.

Is there a fix for CVE-2026-86347?

A patch was published on 2026-09-07: Fix applied via commit 8e88859 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-86347 attacked?

It is attacked over the network.

Am I affected by CVE-2026-86347?

Check whether you run Misp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86347: MISP ACL bypass in TemplatesController uploadFile

CVE-2026-86347 · Severity: medium · CVSS 6.5 · Published 2026-09-07

MISP is an open-source threat intelligence platform used by organizations to share and manage malware samples and security data. A flaw in its file-upload access controls allows any authenticated user—including those with read-only privileges—to repeatedly upload files to the server, consuming disk space without the required administrative permissions. While uploaded files cannot be directly executed or accessed via the web, this enables denial-of-service attacks that could degrade platform availability.

Technologies: Misp. Vendors: Misp.

Quick answers

Is CVE-2026-86347 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86347 being exploited in the wild.
How severe is CVE-2026-86347?: Medium severity, with a CVSS score of 6.5, published 7 September 2026.
Which products and versions are affected?: Misp ≤2.5.45.
Is there a fix for CVE-2026-86347?: A patch was published on 2026-09-07: Fix applied via commit 8e88859 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-86347 attacked?: It is attacked over the network.
Am I affected by CVE-2026-86347?: Check whether you run Misp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A wildcard ACL entry ("*") in TemplatesController::uploadFile() incorrectly granted access to any authenticated user, bypassing intended role-based restrictions requiring perm_add or perm_template permissions. The upload handler accepts arbitrary file content with minimal validation (only checking that size > 0 and upload error == 0), writing files to app/tmp/files/ with randomly-generated names. An attacker with any authenticated account, including read-only roles, can exploit this to perform repeated uploads and exhaust server disk space. The impact is limited to disk consumption; files are stored outside the web root, receive random names preventing traversal, and are not directly served over HTTP, ruling out RCE, XSS, or arbitrary file overwrite. The fix restricts the ACL requirement from "*" to "perm_add" to align with neighboring template-management actions.

Affected products

MISP MISP ≤2.5.45

Timeline

2026-09-07: disclosed
2026-09-07: patched: Fix applied via commit 8e88859

References

https://github.com/MISP/MISP/commit/8e8885971

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.