Xenforo CVE-2026-35056

Attacker must have admin panel access to XenForo 2.3.8 or earlier, or 2.2.17 or earlier. Requires authenticated admin user credentials. No victim interaction needed. Remote code execution executed server-side via admin panel.

Real-world risk is elevated but context-dependent. The CVSS 4.0 score of 8.7 reflects high confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H) with straightforward exploitation (AC:L/AT:N/UI:N). However, the PR:L requirement significantly constrains the attack surface to scenarios involving credential compromise, malicious insiders, or supply-chain attacks targeting admin accounts. EPSS data not provided, but no CISA KEV listing or public POC confirms this is not confirmed actively exploited. The SSVC decision framework would classify this as medium priority for most organizations: exploitation requires authenticated admin access (not automatable from external position), technical impact is total system compromise, but the attack prerequisite limits mass exploitation potential. Organizations with untrusted or poorly monitored admin users face higher risk. The vulnerability is more critical for shared hosting environments or managed service providers where admin access may be distributed across multiple parties.

An attacker compromises admin credentials through phishing, credential stuffing, or session hijacking and authenticates to the XenForo admin panel. Leveraging the code injection vulnerability, the attacker submits malicious input through an admin interface feature (such as template editing, plugin configuration, or custom field definitions) that is improperly sanitized. The crafted payload executes arbitrary PHP code on the server with web server privileges, allowing the attacker to install a web shell, exfiltrate the forum database containing user credentials and private messages, modify forum content for SEO poisoning or malware distribution, or pivot to other systems on the internal network.