CVE-2026-35056 - Vulnerability Analysis

Overview

XenForo < 2.3.9 and < 2.2.18 contains a remote code execution caused by malicious input from authenticated admin users, letting attackers with admin panel access execute arbitrary code on the server, exploit requires admin privileges.

Severity & Score

Impact

Authenticated admin users can execute arbitrary code on the server, leading to full system compromise.

Mitigation

Update to version 2.3.9 or 2.2.18 or later.

References

• https://www.vulncheck.com/advisories/xenforo-remote-code-execution-via-authenticated-admin
• https://xenforo.com/community/threads/xenforo-2-3-9-inc-xfmg-2-2-18-released-security-fix.235659/

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner