Puppet Enterprise EUVD-2026-116495

Exploitation requires the attacker to submit a report containing a crafted rich-data type via a PUT request to the Puppet Server's report-processing endpoint, and to hold any CA-signed agent certificate (reflected as PR:L). The key limiting factor is this certificate requirement: in a properly configured CA that does not autosign, or that autosigns only with strong verification, the attacker must already control a legitimately enrolled agent. The condition is substantially WEAKENED where the certificate authority is configured to autosign certificate requests without strong verification - in that specific deployment mode, an unauthenticated network attacker can obtain a valid certificate on demand and proceed, effectively removing the authentication barrier. No user interaction is required. Affects the Puppet report-processing code as used by Puppet Server in the affected releases.

This is a genuine high-priority issue, not a high-CVSS-but-low-risk paper finding. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity flaw whose only access barrier is possession of a CA-signed agent certificate (PR:L), and CWE-502 untrusted-data deserialization reaching code execution as the Puppet Server service user is a well-understood, reliable bug class. The vuln.today decision label is act_now, reinforcing urgency. The signals are largely aligned: high CVSS plus act_now point to immediate remediation. However, several signals are MISSING rather than conflicting - there is no EPSS probability, no CISA KEV listing, and no public exploit reference in the provided data, so there is no evidence of active or at-scale exploitation yet; the urgency here derives from the intrinsic severity and the low exploitation bar, not from observed in-the-wild activity. One important nuance to verify: PR:L assumes the attacker already holds any valid agent certificate, but the description notes that where the CA autosigns requests without strong verification, an unauthenticated network attacker can obtain one - effectively lowering the real-world barrier toward PR:N in autosign deployments. Treat the certificate requirement as a configuration-dependent mitigation, not a guaranteed one.

An attacker possessing any CA-signed Puppet agent certificate submits a report to the Puppet Server via a PUT request containing a crafted rich-data type, triggering unsafe deserialization that executes arbitrary code as the Puppet Server service user. In environments where the CA autosigns certificate requests without strong verification, an unauthenticated network attacker can first obtain a valid certificate and then perform the same attack. No public exploit code is identified in the available data, but the attack is mechanically straightforward given the deserialization primitive.