CVE-2026-82486

MediumCVSS 5.0

Published: 30/08/2026(UTC)Updated: 31/08/2026(UTC)Translated: 30/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

11th percentile - higher than 11% of all known CVEs

Summary

A vulnerability was found in SiteServer SSCMS 7.4.0, affecting the Agent Installation Workflow component. Manipulating the SecurityKey argument results in improper access controls. Remote exploitation is possible but has high complexity and is difficult. The project did not respond.

Risk Assessment

The risk includes remote bypass of access controls, potentially leading to unauthorized actions, but due to high complexity, exploitation is difficult.

Recommendation

It is recommended to monitor project communications and apply patches when available, and restrict access to the component.

Other vulnerabilities in SiteServer SSCMS

CVE-2026-111658Low
SiteServer SSCMS through 7.4.0 contains an authorization bypass vulnerability in ChannelsController that allows site-scoped administrators to access other sites' channels by supplying foreign channel IDs. Attackers with Channels permission on one site can read and overwrite another site's channel names, file paths, templates, link URLs, and custom fields, breaking multi-site isolation.

Original NVD description (English source)

A vulnerability was found in SiteServer SSCMS 7.4.0. Affected by this issue is some unknown functionality of the component Agent Installation Workflow. Performing a manipulation of the argument SecurityKey results in improper access controls. Remote exploitation of the attack is possible. The attack is considered to have high complexity. The exploitation is known to be difficult. The project was informed of the problem early through an issue report but has not responded yet.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS