PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-26026 glpi-project CVE debrief

CVE-2026-26026 debrief based on the supplied source corpus. The CVE record was published on 2026-04-06T15:17:07.093Z. GLPI versions from 11.0.0 to before 11.0.6 are vulnerable to template injection by an administrator, leading to RCE. The vulnerability is fixed in version 11.0.6. Defenders should prioritize verifying exposure and applying patches to prevent potential attacks. This vulnerability allows for RCE via template injection by an administrator, impacting GLPI systems. The CVE record and NVD entry provide details on the template injection vulnerability in GLPI, which can lead to RCE.

Vendor
glpi-project
Product
glpi
CVSS
CRITICAL 9.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-06
Original CVE updated
2026-10-26
Advisory published
2026-04-06
Advisory updated
2026-10-26

Who should care

GLPI administrators and users should assess exposure and apply patches to prevent potential RCE. This includes reviewing system configurations for potential exposure, monitoring system logs for suspicious activity, and verifying GLPI version and patch application. Operators, platform administrators, vulnerability management teams, and security teams should prioritize verifying exposure and applying patches.

Why it matters

CVE-2026-26026 is a critical vulnerability in GLPI that allows for RCE via template injection by an administrator. Defenders should prioritize verifying exposure and applying patches to prevent potential attacks.

  • Potential RCE via template injection
  • Exposure of GLPI systems to administrator-level attacks
  • Need for verification of GLPI version and patch application
  • Potential disruption of IT asset management services

Technical summary

GLPI versions from 11.0.0 to before 11.0.6 are vulnerable to template injection by an administrator, leading to RCE. The vulnerability is fixed in version 11.0.6. This vulnerability allows for RCE via template injection by an administrator, impacting GLPI systems. Technical details indicate that template injection can lead to RCE, emphasizing the need for patch application.

Defensive priority

Defenders should prioritize verifying exposure and applying patches for GLPI versions between 11.0.0 and 11.0.6.

Recommended defensive actions

  • Verify GLPI version and apply patch if necessary
  • Review system configurations for potential exposure
  • Monitor system logs for suspicious activity

Evidence notes

The CVE record and NVD entry provide details on the template injection vulnerability in GLPI, which can lead to RCE. The vendor has released a fix in version 11.0.6.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-26026 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-26026

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-26026 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-26026

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.