CERT-PY expands MISP vulnerability alerts

Update Sept. 19, 2026: CERT-PY added an alert about critical vulnerabilities in Ubiquiti products with remote code execution risk, and five new MISP flaws were also disclosed, separate from the ones already covered in this article. They include a critical authentication bypass, CLI shell inconsistencies, stored XSS, and a CSRF bypass, with a general fix in MISP 2.5.46 or later.

CERT.gov.py published an advisory titled "Vulnerability in MISP products" and said it had identified a high-severity flaw in the open source threat intelligence platform MISP. At the same time, it issued another advisory on "Vulnerabilities in WordPress plugins," focused on flaws affecting plugins, including a privilege escalation case and account hijacking in Bulk Password Reset.

What did CERT.gov.py report about MISP?

CERT.gov.py warned about a high-severity vulnerability in MISP and paired that notice with several identifiers and mitigation recommendations. The technical reporting also shows how different sources described the issue's scope in specific versions of the platform and the steps recommended to reduce exposure.

NIST NVD's advisory for CVE-2026-86418 says MISP exposes organization metadata from the dashboard selector and that the flaw affects MISP versions up to and including 2.5.45. OpenCVE, for its part, recommended updating to MISP 2.5.46 or later for CVE-2026-86440, and pointed to validation changes meant to block javascript: URLs, backslash-based authorities, control characters, and unauthorized absolute origins.

OpenCVE also describes CVE-2026-86441 as a vulnerability affecting all MISP versions through 2.5.45 and recommends updating to MISP 2.5.46 or applying official patches. It also says that, if updating is not possible, the affected widgets should be temporarily disabled. In the case of CVE-2026-86452, OpenCVE notes that it affects all MISP installations running version 2.5.45 or earlier, regardless of deployment size.

What changed in the recent MISP alerts?

Between Sept. 14 and 15, 2026, five new MISP vulnerabilities were disclosed, with severities ranging from critical to medium and impact through version 2.5.45. The cases include an authentication bypass in the LdapAuth and LinOTPAuth plugins, authorization inconsistencies in the CLI shell, a stored XSS, dashboard permission flaws, and a CSRF bypass.

CVE-2026-90961 describes a critical authentication bypass in MISP's LdapAuth and LinOTPAuth plugins that lets an attacker authenticate by knowing only a valid email address. Ionix Threat Center assigns it a CVSS score of 9.3 and recommends immediately updating to MISP 2.5.46 or later.

CVE-2026-90955 affects MISP's interactive CLI shell through version 2.5.45, where the identity of the impersonated user is not properly preserved in audit logs. Strix rates it CVSS 4.6 and advises updating to 2.5.46. The GHSA-rx79-g748-j44m advisory, tied to CVE-2026-90895, adds that the CLI shell enforces access controls separately from the web application and creates discrepancies in sensitive areas, while GitHub Advisory Database also lists 2.5.46 as the mitigation.

CVE-2026-90957 documents a stored XSS in MISP through version 2.5.45 via organization logos and SVG report images served inline without a restrictive sandbox. OpenCVE says the flaw can let authenticated users run arbitrary code in the browser and that no official advisories are available yet, although it does recommend updating.

What other flaws appeared in MISP?

Vulnerability databases also added CVE-2026-91859, CVE-2026-91851, and CVE-2026-91819 for MISP through version 2.5.45. Together, they broaden the picture with an information disclosure issue, incorrect filtering of restricted dashboard templates, and a bypass of CSRF protection using the _method parameter in cross-site requests.

CVE-2026-91859 was published on Sept. 15, 2026, and according to Feedly CVE Tracker there is no evidence of exploitation or public exploits. The same record recommends applying the available patch and keeping the software updated.

CVE-2026-91851, according to GitHub's advisory, can expose views or functions to unauthorized roles because restricted dashboard templates are filtered incorrectly. CVE-2026-91819, according to Feedly CVE Tracker, can be exploited by unauthenticated attackers through cross-site requests and has no PoC or confirmed exploitation, although the potential impact includes unwanted actions on vulnerable instances.

What happened with the WordPress plugins?

CERT.gov.py also published an advisory on vulnerabilities in WordPress plugins and, in an associated snippet, mentioned privilege escalation and account hijacking in the Bulk Password Reset plugin because of missing identity validation. That publication is separate from the MISP advisory and shows the agency issued more than one alert during the same period.

The material provided does not include other plugin names, affected versions, or specific mitigation measures for the WordPress case. What is confirmed is that the advisory existed and that at least one of the associated findings involved weak identity validation as the starting point of the issue.

What do consolidated databases say about mitigation?

Consolidated vulnerability listings for MISP agree that most of the recent critical and high-severity flaws are mitigated by updating to at least version 2.5.46. That reference matches the independent advisories and serves as a practical cutoff for deployments following CERT-PY's alerts.

CyStack also maintains consolidated security views for MISP and its product, where it groups these recent reports together with other vulnerabilities in the ecosystem. In that view, version 2.5.46 is the repeated cutoff cited by several technical sources for closing much of the newly disclosed exposure.

CERT-PY also added an alert about critical vulnerabilities in Ubiquiti products and warned that a malicious actor could achieve remote code execution.