PatchTheCVECVE-2026-5383: An issue that could allow access to Explorer groups from outside of the authorized organization scope has been
CVE-2026-5383 is a medium-severity flaw (CVSS 4.4) affecting runzero platform. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
An issue that could allow access to Explorer groups from outside of the authorized organization scope has been resolved. This is an instance of CWE-863: Incorrect Authorization, and has an estimated CVSS score of CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:L (4.4 Medium). This issue was fixed in version 4.0.260208.0 of the runZero Explorer.
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 4.4 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | High |
| Privileges needed | High |
| User interaction | None |
| EPSS exploit chance | 0.2% (top 93%) |
| CISA exploited list | No |
| Weakness | CWE-863 |
| Published | 2026-04-07 |
| Last modified | 2026-10-26 |
Last updated 2026-10-26 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-5383?
runzero platform: upgrade to 4.0.260208.0. Exact commands for each OS are on this page.
Is CVE-2026-5383 being exploited?
CVE-2026-5383 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-5383 affect?
CVE-2026-5383 affects runzero platform. Severity is medium (CVSS 4.4). An issue that could allow access to Explorer groups from outside of the authorized organization scope has been resolved. This is an instance of CWE-863: Incorrect Authorization, and has an estimated CVSS score of CVSS:3.1/AV:N/AC:H/PR:H/UI:
How urgent is CVE-2026-5383?
Priority 17/100. No elevated risk signals yet.
Related CVEs
- CVE-2026-5372 MEDIUM 6.4 DOWNGRADE An issue that allowed a SQL injection attack vector related to saved queries (introduced in version 4.0.260123
- CVE-2026-5376 MEDIUM 5.9 UPGRADE An issue that could prevent session inactivity timeouts from triggering due to automatic page reloading has be
- CVE-2026-5373 HIGH 8.1 UPGRADE An issue that allowed all-organization administrators to promote accounts to superuser status has been resolve
- CVE-2026-5374 MEDIUM 5.8 UPGRADE An issue that allowed MCP agents to access remediation and asset information from outside of the authorized or
- CVE-2026-5384 MEDIUM 5.8 UPGRADE An issue that could allow a credential to be updated and used for a task from outside of the authorized organi