PatchTheCVEacquia vulnerabilities
Recent CVEs affecting acquia products. 21 tracked.
acquia has 21 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 20. Most recent: 2026-02-24. Highest priority: CVE-2024-47051 (score 51/100).
- CVE-2025-9954 HIGH 7.5 UPGRADE Missing Authorization vulnerability in Drupal Acquia DAM allows Forceful Browsing.This issue affects Acquia DA
- CVE-2026-3105 HIGH 7.6 UPGRADE SummaryThis advisory addresses a SQL injection vulnerability in the API endpoint used for retrieving contact a
- CVE-2025-14472 HIGH 8.1 UPGRADE Cross-Site Request Forgery (CSRF) vulnerability in Drupal Acquia Content Hub allows Cross Site Request Forgery
- CVE-2024-47059 MEDIUM 4.3 DOWNGRADE When logging in with the correct username and incorrect weak password, the user receives the notification, tha
- CVE-2024-47058 LOW 2.9 UPGRADE With access to edit a Mautic form, the attacker can add Cross-Site Scripting stored in the html filed
- CVE-2024-47055 MEDIUM 4.3 UPGRADE SummaryThis advisory addresses a security vulnerability in Mautic related to the segment cloning functionality
- CVE-2024-47053 HIGH 7.7 UPGRADE This advisory addresses an authorization vulnerability in Mautic's HTTP Basic Authentication implementation
- CVE-2024-47051 CRITICAL 9.1 UPGRADE This advisory addresses two critical security vulnerabilities present in Mautic versions before 5.2.3
- CVE-2024-47050 MEDIUM 5.4 UPGRADE Prior to this patch being applied, Mautic's tracking was vulnerable to Cross-Site Scripting through the Page U
- CVE-2024-13261 LOW 3.5 UPGRADE Cross-Site Request Forgery (CSRF) vulnerability in Drupal Acquia DAM allows Cross Site Request Forgery.This is
- CVE-2022-25777 MEDIUM 6.5 UPGRADE Prior to the patched version, an authenticated user of Mautic could read system files and access the internal
- CVE-2022-25776 HIGH 8.3 UPGRADE Prior to the patched version, logged in users of Mautic are able to access areas of the application that they
- CVE-2022-25775 MEDIUM 6.6 UPGRADE Prior to the patched version, logged in users of Mautic are vulnerable to an SQL injection vulnerability in th
- CVE-2022-25774 MEDIUM 4.8 UPGRADE Prior to the patched version, logged in users of Mautic are vulnerable to a self XSS vulnerability in the noti
- CVE-2022-25773 MEDIUM 4.3 UPGRADE This advisory addresses a file placement vulnerability that could allow assets to be uploaded to unintended di
- CVE-2022-25770 HIGH 7.8 UPGRADE Mautic allows you to update the application via an upgrade script. The upgrade logic isn't shielded off corre
- CVE-2022-25769 HIGH 7.2 UPGRADE ImpactThe default .htaccess file has some restrictions in the access to PHP files to only allow specific PHP f
- CVE-2022-25768 HIGH 7.0 UPGRADE The logic in place to facilitate the update process via the user interface lacks access control to verify if p
- CVE-2021-27917 HIGH 7.3 UPGRADE Prior to this patch, a stored XSS vulnerability existed in the contact tracking and page hits report.
- CVE-2021-27916 HIGH 8.1 UPGRADE Prior to the patched version, logged in users of Mautic are vulnerable to Relative Path Traversal/Arbitrary Fi
- CVE-2021-27915 HIGH 7.6 UPGRADE Prior to the patched version, there is an XSS vulnerability in the description fields within the Mautic applic
FAQ
How do I fix acquia vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is acquia being exploited right now?
None of the tracked acquia CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which acquia CVE should I patch first?
CVE-2024-47051 currently ranks highest (51/100): This advisory addresses two critical security vulnerabilities present in Mautic versions before 5.2.3.