Spotfire Enterprise EUVD-2026-43678

Exploitation requires no authentication (PR:N) and no elevated privileges, but is gated by passive user interaction (UI:P): a legitimate user must be induced to perform an action such as opening a crafted link or loading attacker-supplied content served through the network-reachable Spotfire Server web interface. The affected feature is the Spotfire Server modules common to Spotfire Enterprise, Spotfire Enterprise with External Consumers, and Spotfire on Kubernetes at or below the listed versions. Limiting factors: the server must be network-reachable by the attacker (or the malicious content must reach a user with access), the target must run a vulnerable version, and successful attack depends on the victim taking the interaction step - with no automated/wormable path indicated (AT:N but UI:P) and no evidence of active exploitation.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) describes a network-reachable, low-complexity, unauthenticated flaw whose only meaningful barrier is required passive user interaction (UI:P), yielding a High 8.7 score. Real-world urgency is moderated by several missing signals: no EPSS probability was provided, the CVE is not in CISA KEV, and no proof-of-concept is referenced - so there is no evidence of active or automated exploitation, and exploitation depends on social-engineering a victim. Note a tension in the data: the vendor tag labels this 'Information Disclosure,' yet the vector asserts VI:H (high integrity impact), so the flaw is broader than pure data leakage - verify the exact impact with the Spotfire advisory. Overall this is a legitimately High-severity, patch-worthy issue for internet-facing Spotfire Servers, but the user-interaction requirement and absence of exploit evidence place it below drop-everything emergencies like KEV-listed unauthenticated RCE.

An attacker crafts a malicious link or analysis payload targeting an internet-facing Spotfire Server and delivers it to a legitimate user via email or a web page. When the victim opens it (the passive UI:P interaction), the server processes attacker-influenced content that leaks sensitive data and allows the attacker to tamper with server-side state. No proof-of-concept is publicly identified at time of analysis, so exploitation would require original development.