Which versions of Xenforo are affected by EUVD-2026-17743?

XenForo installations are vulnerable to remote code execution through the administrative panel, allowing authenticated admins with compromised credentials to execute arbitrary code and achieve…. A patch is available.

How to fix or mitigate EUVD-2026-17743?

Within 24 hours: Identify all XenForo instances and document current versions (vulnerable if <2.3.9 or <2.2.18). Audit admin account access logs for suspicious activity in the past 90 days. Within 7 days: Apply vendor patches-upgrade to XenForo 2.3.9 or 2.2.18 (or later stable versions) and implement administrative credential rotation for all accounts with admin panel access. Within 30 days: Implement multi-factor authentication for all administrative accounts, restrict admin panel access by IP address/VPN, and establish enhanced logging for admin panel activities.

Xenforo EUVD-2026-17743

Q: What is the CVSS score of EUVD-2026-17743?

EUVD-2026-17743 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-35056 HIGH

Code Injection (CWE-94)

2026-04-01 VulnCheck

RCE Code Injection Xenforo

8.6

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:09 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

2.3.9,2.2.18

EUVD ID Assigned

Apr 01, 2026 - 01:15 euvd

EUVD-2026-17743

Analysis Generated

Apr 01, 2026 - 01:15 vuln.today

CVE Published

Apr 01, 2026 - 00:30 nvd

HIGH 8.6

DescriptionCVE.org

XenForo before 2.3.9 and before 2.2.18 allows remote code execution (RCE) by authenticated, but malicious, admin users. An attacker with admin panel access can execute arbitrary code on the server.

AnalysisAI

Remote code execution in XenForo versions prior to 2.3.9 and 2.2.18 allows authenticated administrators to execute arbitrary code on the server. Attack requires low-privilege admin panel access (PR:L) with network accessibility (AV:N) and low complexity (AC:L). No public exploit identified at time of analysis, though VulnCheck published technical analysis. This represents a supply-chain or insider-threat risk where compromised admin credentials or malicious insiders could achieve complete server compromise.

Technical ContextAI

XenForo is a PHP-based forum software platform. This vulnerability stems from CWE-94 (Improper Control of Generation of Code / Code Injection), indicating inadequate input validation or sanitization of data processed by authenticated administrators. The admin panel likely accepts user-controlled input that is subsequently evaluated or executed as code without sufficient restrictions. Given the PHP ecosystem typical to XenForo (cpe:2.3:a:xenforo:xenforo), this could involve unsafe use of functions like eval(), unserialize(), or template engine exploits that permit code injection when admin-level users supply crafted payloads. The CVSS vector confirms network-accessible exploitation with no user interaction required once admin access is obtained.

RemediationAI

Upgrade immediately to XenForo 2.3.9 or later for 2.3.x installations, or XenForo 2.2.18 or later for 2.2.x installations per the official vendor security advisory at https://xenforo.com/community/threads/xenforo-2-3-9-inc-xfmg-2-2-18-released-security-fix.235659/. No workarounds are documented; patching is the only confirmed mitigation. As an interim risk reduction measure, organizations should audit admin user accounts, enforce strong authentication with MFA for admin panel access, monitor admin activity logs for suspicious behavior, and restrict admin panel access to trusted IP ranges via firewall rules or web application firewall policies. Review and revoke unnecessary admin privileges following least-privilege principles.