PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-105409 Dassault Systèmes CVE debrief

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-10-12T10:45:01.159Z and has not been modified since then. The vulnerability affects Tuleap Enterprise Edition from version 17.0 through 17.5, allowing attackers to execute arbitrary script code in user's browser sessions. Defenders should assess exposure, verify security controls, and monitor user sessions. The CVSS score is 8.7, indicating high severity. Official CVE Program record and NIST NVD detail page provide additional information.

Vendor
Dassault Systèmes
Product
Tuleap Enterprise Edition
CVSS
HIGH 8.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-12
Original CVE updated
2026-10-12
Advisory published
2026-10-12
Advisory updated
2026-10-12

Who should care

Defenders responsible for Tuleap Enterprise Edition deployments, especially those using versions 17.0 through 17.5, should assess exposure and prioritize verifying the effectiveness of current security controls against cross-site scripting attacks.

Why it matters

CVE-2026-105409 is a Stored Cross-site Scripting (XSS) vulnerability in Tuleap Enterprise Edition from version 17.0 through 17.5, allowing attackers to execute arbitrary script code in user's browser sessions. Defenders should prioritize verifying exposure, updating security controls, and monitoring user sessions.

  • Defenders need to verify exposure in Tuleap Enterprise Edition deployments
  • Security controls against cross-site scripting attacks may require updates
  • Monitoring user browser sessions for suspicious activity is necessary

Technical summary

A Stored Cross-site Scripting (XSS) vulnerability affects Tuleap Enterprise Edition from version 17.0 through 17.5. The vulnerability could allow an attacker to execute arbitrary script code in a user's browser session. The CVSS score is 8.7, indicating a high severity.

Defensive priority

Defenders should prioritize verifying exposure in Tuleap Enterprise Edition deployments, especially for versions 17.0 through 17.5, and assess the effectiveness of current security controls against cross-site scripting attacks.

Recommended defensive actions

  • Verify Tuleap Enterprise Edition version and update to a fixed version if necessary
  • Implement additional security controls to prevent cross-site scripting attacks
  • Monitor user browser sessions for suspicious activity

Evidence notes

The CVE record and source item provide details on a Stored Cross-site Scripting (XSS) vulnerability in Tuleap Enterprise Edition from version 17.0 through 17.5. The vulnerability could allow an attacker to execute arbitrary script code in a user's browser session. The CVSS score is 8.7, indicating a high severity.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-105409 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-105409

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-105409 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-105409

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.