PatchTheCVEsherpa orchestrator vulnerabilities and fixes
Recent CVEs affecting sherpa orchestrator, with upgrade or downgrade steps. 4 tracked.
Also searched as: sherpaorchestrator.
sherpa orchestrator has 4 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 0. Most recent: 2025-04-25. Highest priority: CVE-2025-46544 (score 28/100).
- CVE-2025-46547 MEDIUM 5.4 DOWNGRADE In Sherpa Orchestrator 141851, the web application lacks protection against CSRF attacks, with resultant effec
- CVE-2025-46546 LOW 3.5 DOWNGRADE In Sherpa Orchestrator 141851, multiple time-based blind SQL injections can be performed by an authenticated u
- CVE-2025-46545 MEDIUM 4.4 DOWNGRADE In Sherpa Orchestrator 141851, the functionality for adding or updating licenses allows for stored XSS attacks
- CVE-2025-46544 MEDIUM 6.4 DOWNGRADE In Sherpa Orchestrator 141851, a low-privileged user can elevate their privileges by creating new users and ro
FAQ
How do I fix sherpa orchestrator vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is sherpa orchestrator being exploited right now?
None of the tracked sherpa orchestrator CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which sherpa orchestrator CVE should I patch first?
CVE-2025-46544 currently ranks highest (28/100): In Sherpa Orchestrator 141851, a low-privileged user can elevate their privileges by creating new users and ro.