CVE-2026-115731: critical vulnerability in Perforce Puppet Enterprise
Report Deserialization Code Execution
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.4epss 0.4%
Deserialization of untrusted data in the report-processing code of Puppet, as used by Puppet Server, in the affected releases, allows a client that holds any CA-signed agent certificate to execute arbitrary code on the Puppet Server as its service user by submitting a report containing a crafted rich-data type via PUT request. Where the certificate authority autosigns requests without strong verification, an unauthenticated network attacker can obtain such a certificate.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Affected products
Perforce · Puppet EnterpriseRelated CVEs — Perforce Puppet Enterprise
In the same product, most dangerous first.
CVE-2025-5459HIGHOS Command InjectionEPSS 1.1%CVE-2026-115732CRITICALCertificate Name Authorization BypassEPSS 0.7%CVE-2025-10360MEDIUMInsufficiently Protected Credentials in Puppet Enterprise 2025.4 and 2025.5EPSS 0.2%CVE-2026-8804MEDIUMCleartext Storage of Sensitive Information for Puppet Resource APIEPSS 0.1%