PatchTheCVEalteryx server vulnerabilities and fixes
Recent CVEs affecting alteryx server, with upgrade or downgrade steps. 4 tracked.
Also searched as: alteryxserver.
alteryx server has 4 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 1. Most recent: 2025-11-14. Highest priority: CVE-2025-28244 (score 47/100).
- CVE-2025-63291 MEDIUM 5.4 UPGRADE When processing API requests, the Alteryx server 2022.1.1.42654 and 2024.1 used MongoDB object IDs to uniquely
- CVE-2025-28245 MEDIUM 6.1 DOWNGRADE Cross-site scripting (XSS) vulnerability in Alteryx Server 2023.1.1.460 allows remote attackers to inject arbi
- CVE-2025-28244 HIGH 8.8 DOWNGRADE Insecure Permissions vulnerability in the Local Storage in Alteryx Server 2023.1.1.460 allows remote attackers
- CVE-2025-28243 HIGH 8.0 DOWNGRADE An issue in Alteryx Server v.2023.1.1.460 allows HTML injection via a crafted script to the pages component.
FAQ
How do I fix alteryx server vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is alteryx server being exploited right now?
None of the tracked alteryx server CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which alteryx server CVE should I patch first?
CVE-2025-28244 currently ranks highest (47/100): Insecure Permissions vulnerability in the Local Storage in Alteryx Server 2023.1.1.460 allows remote attackers.