CVE-2026-46458 ICU Scandinavia CVE debrief

Who should care

Defenders responsible for ICU Scandinavia Boomerang installations, especially those with internet-exposed systems, should assess exposure and prioritize remediation. This includes verifying exposure, retrieving and reviewing credentials, restricting access to sensitive credential files and XML files, and updating to version 2.4.18.029 or later. Security teams and vulnerability management teams should focus on remediation efforts for affected systems.

Why it matters

CVE-2026-46458 is a high-severity information disclosure vulnerability in ICU Scandinavia Boomerang, allowing unauthenticated remote attackers to retrieve sensitive credentials. Defenders should prioritize verifying exposure, retrieving and reviewing credentials, restricting access, and updating to version 2.4.18.029 or later.

• Verify exposure of Boomerang installations to the internet
• Retrieve and review plaintext service account and SMTP credentials
• Restrict access to sensitive credential files and XML files
• Update Boomerang to version 2.4.18.029 or later

Technical summary

The vulnerability allows an unauthenticated remote attacker to retrieve plaintext service account and SMTP credentials by requesting specific XML files from the webroot. This issue affects ICU Scandinavia Boomerang and has been fixed in version 2.4.18.029. Defenders should prioritize verifying exposure and remediating vulnerable instances, focusing on systems with internet-exposed Boomerang installations. The vulnerability is a high-severity information disclosure issue, allowing attackers to obtain sensitive credentials.

Defensive priority

Defenders should prioritize verifying exposure and remediating vulnerable instances, focusing on systems with internet-exposed Boomerang installations.

Recommended defensive actions

• Verify Boomerang installations for exposure to the internet and check for sensitive credential files
• Retrieve and review plaintext service account and SMTP credentials from exposed XML files
• Update Boomerang to version 2.4.18.029 or later
• Restrict access to sensitive credential files and XML files
• Monitor for unauthorized access to sensitive credentials

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but additional information on affected versions and remediation steps is limited. The issue affects ICU Scandinavia Boomerang installations, particularly those with internet-exposed systems. Defenders should verify exposure, retrieve and review credentials, restrict access, and update to version 2.4.18.029 or later. Evidence is based on CVE and NVD data, with limited additional context from other sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.