Burp Suite DAST EUVD-2026-86005

Exploitation requires network reachability to the Burp Suite DAST (formerly Burp Suite Enterprise Edition) management interface and an undisclosed attack precondition (CVSS 4.0 AT:P), then abuse of an alternate path or channel to bypass authentication (CWE-288). No user interaction or prior authentication is required (UI:N, PR:N). Realistic exposure is limited by the fact that this is an internal enterprise scanning platform usually deployed on segmented networks rather than internet-facing, and by the unspecified condition that must be met for the alternate-channel bypass to succeed; only versions before 2026.8 are affected.

Signals are mixed and point to a serious-but-not-imminent priority. The CVSS 4.0 base score is 9.2 (critical) driven by AV:N, PR:N (unauthenticated) and high VC/VI/VA, describing a remote unauthenticated authentication bypass with full technical impact on the scan platform. However, several signals temper this: the vector includes AT:P (attack requirements present), meaning exploitation depends on an undisclosed precondition rather than being trivially reachable; SSVC scores Exploitation=none, Automatable=no, Technical Impact=total. There is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis. The AT:P requirement plus the fact that Burp Suite DAST's management interface is typically an internal/segmented enterprise deployment substantially narrows realistic exposure versus the raw 9.2. Net: a genuine high-severity flaw worth prompt patching, but not evidence of active mass exploitation. The vector's SC:L/SI:L/SA:L implies cross-system impact - consistent with the platform holding credentials for scan targets - but no vendor detail confirms this scope, so treat subsequent-system impact as inferred.

An attacker who can reach the Burp Suite DAST management interface uses an alternate path or channel to bypass authentication and gain control of the scanning platform, which typically stores credentials for the applications it scans. No public proof-of-concept exists, and exploitation appears to depend on an undisclosed precondition (CVSS AT:P), so this is more plausible against exposed or misconfigured deployments than as a turnkey remote attack.