Quick answers
- Is CVE-2026-95659 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-95659 being exploited in the wild.
- How severe is CVE-2026-95659?
- Informational severity, published 22 September 2026.
- Which products and versions are affected?
- Misp before 2.5.47.
- Is there a fix for CVE-2026-95659?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-95659 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-95659?
- Check whether you run Misp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The AnalystDataController::viewForObject action accepts an unvalidated parent object type parameter from the URL and passes it to the Overmind theme's AnalystData thread view element, where it is interpolated into translated strings and rendered without output encoding. The vulnerability is a reflected XSS requiring authentication and user interaction (victim must click the crafted URL). An attacker can execute arbitrary JavaScript in the victim's browser with access to their session context; the fix validates the object type against AnalystData::valid_targets and escapes output at both sinks.
Affected products
- MISP MISP before 2.5.47
Timeline
- 2026-09-22: disclosed