PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-105408 Dassault Systèmes CVE debrief

CVE-2026-105408 is a Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from version 17.0 through 17.5. An attacker could potentially execute arbitrary script code in a user's browser session. The CVSS score is 8.7, indicating a high severity. The vulnerability was published on October 12, 2026, and has not been modified since then.

Vendor
Dassault Systèmes
Product
Tuleap Enterprise Edition
CVSS
HIGH 8.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-12
Original CVE updated
2026-10-12
Advisory published
2026-10-12
Advisory updated
2026-10-12

Who should care

Defenders responsible for Tuleap Enterprise Edition deployments, particularly those using versions 17.0 through 17.5, should assess exposure and prioritize remediation.

Why it matters

CVE-2026-105408 is a high-severity Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition. Defenders should prioritize verifying exposure and applying remediation to prevent potential script code execution in user browser sessions.

  • Potential execution of arbitrary script code in user browser sessions
  • Required verification of exposure for Tuleap Enterprise Edition versions 17.0 through 17.5
  • Prioritized remediation based on CVSS score of 8.7

Technical summary

A Stored Cross-site Scripting (XSS) vulnerability affects Tuleap Enterprise Edition from version 17.0 through 17.5, potentially allowing an attacker to execute arbitrary script code in a user's browser session. The CVSS score is 8.7, indicating a high severity.

Defensive priority

Defenders should prioritize verifying exposure of Tuleap Enterprise Edition versions 17.0 through 17.5 and applying vendor-provided remediation.

Recommended defensive actions

  • Verify exposure of Tuleap Enterprise Edition versions 17.0 through 17.5
  • Apply vendor-provided remediation
  • Monitor for potential script code execution in user browser sessions

Evidence notes

The CVE record and source item provide details on the vulnerability, affected versions, and CVSS score. However, additional information on exploitation, impact, and remediation is limited.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-105408 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-105408

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-105408 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-105408

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.