Squirro Cognitive Search EUVD-2026-60356

The attacker requires network reachability to the Squirro Cognitive Search web/API interface of an instance running a version earlier than 3.14.2, and the ability to send a crafted request that triggers the improper privilege management flaw (CWE-269). The CVSS vector states no authentication (PR:N) and no user interaction (UI:N), which would permit unauthenticated exploitation; however, the description characterizes the outcome as privilege escalation, a framing that often implies some pre-existing access, so the true authentication prerequisite should be confirmed with the vendor. Limiting factors: exposure is bounded to organizations that deploy this specific commercial product and, in practice, to instances that are reachable by the attacker (internet-facing or otherwise network-accessible).

The signals conflict and should be weighed rather than taken at face value. The CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N) and SSVC (automatable=yes, technical impact=total) argue for high urgency, yet the EPSS score is very low (0.21%, 11th percentile), SSVC exploitation status is 'none', and there is no CISA KEV listing - indicating no evidence of exploitation in the wild today. The CVSS PR:N (unauthenticated) rating also sits in tension with the description, which frames the flaw as privilege escalation, an outcome that usually presupposes some existing foothold; this discrepancy should be verified with the vendor. Because the product is a niche enterprise search appliance rather than internet-ubiquitous software, realistic exposure depends heavily on whether instances are internet-facing; still, given total technical impact and automatability, any organization running an affected version - even a mid-sized operator with a lean IT team - should treat patching as a near-term priority rather than deferring it. Net: a genuinely high-severity flaw that is not yet under active exploitation, so prioritize the patch but do not assume compromise.

An attacker with network access to a Squirro Cognitive Search instance running a version below 3.14.2 sends a specially crafted request that the application processes with improper privilege enforcement, granting the attacker elevated rights over indexed data and platform functions. Given the low attack complexity and automatable nature per SSVC, the request could be scripted and reused across exposed instances. No public exploit identified at time of analysis, though a third-party CVE tracking repository referenced in the data may contain further details.