PatchTheCVEmisp vulnerabilities and fixes
Recent CVEs affecting misp, with upgrade or downgrade steps. 9 tracked.
misp has 9 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 9. Most recent: 2026-09-03. Highest priority: CVE-2026-85216 (score 54/100).
- CVE-2026-85239 MEDIUM 6.5 UPGRADE A vulnerability in MISP's event template handling allowed an authenticated user with permission to create or m
- CVE-2026-85238 MEDIUM 6.8 UPGRADE MISP contains a session fixation vulnerability in the CustomAuth authentication (a custom configuration) flow
- CVE-2026-85237 HIGH 8.1 UPGRADE A vulnerability in MISP's email-based one-time password (OTP) authentication flow allowed an attacker to perfo
- CVE-2026-85236 HIGH 8.8 UPGRADE A cross-site request forgery (CSRF) vulnerability existed in the cullEmptyEvents action of MISP
- CVE-2026-85216 CRITICAL 9.8 UPGRADE MISP contains an authentication bypass vulnerability in its LDAP and LinOTP authentication components due to i
- CVE-2026-85221 CRITICAL 9.1 UPGRADE MISP contains an improper TLS certificate validation vulnerability in CurlClient
- CVE-2026-85226 MEDIUM 4.3 UPGRADE MISP contains an authorization flaw in the OnDemand correlation engine where correlations were calculated sole
- CVE-2026-85227 MEDIUM 6.1 UPGRADE MISP contains a reflected Cross-Site Scripting (XSS) vulnerability in the event attribute filtering query buil
- CVE-2026-85230 MEDIUM 5.4 UPGRADE A persistent unsafe URL injection vulnerability exists in the MISP dashboard ButtonWidget configuration
FAQ
How do I fix misp vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is misp being exploited right now?
None of the tracked misp CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which misp CVE should I patch first?
CVE-2026-85216 currently ranks highest (54/100): MISP contains an authentication bypass vulnerability in its LDAP and LinOTP authentication components due to i.