Tuleap Enterprise Edition EUVD-2026-97326

Exploitation requires an authenticated session on the target Tuleap Enterprise Edition instance: the CVSS vector specifies PR:L, meaning the attacker must hold at least a low-privilege account (e.g., a registered project or site user) before reaching the vulnerable command-handling code path. No user interaction is needed (UI:N) and the attack is deliverable over the network (AV:N) against versions 17.0 through 17.5. The limiting factors are therefore the need for valid credentials and exposure of the affected version - instances that restrict account registration, are not network-reachable by untrusted users, or run outside the 17.0-17.5 range are not exploitable. The description does not name the exact feature, configuration setting, or deployment mode involved, so the precise triggering component should be confirmed against the 3DS advisory.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-exploitable, low-complexity OS command injection requiring only low privileges (PR:L) and no user interaction, yielding full confidentiality, integrity, and availability impact - consistent with arbitrary command execution on the server. However, the only corroborating signal beyond the vendor advisory is the CVSS score itself: no EPSS probability, no CISA KEV listing, and no public POC are present in the input. There is therefore no evidence of active or widespread exploitation at this time; the high score reflects worst-case technical impact for an authenticated attacker, not demonstrated real-world weaponization. The requirement for a valid (if low-privileged) account materially narrows the attacker population versus an unauthenticated flaw, so this is best treated as a high-impact but access-gated issue: prioritize patching on internet-exposed or multi-tenant Tuleap instances where untrusted users can obtain accounts, while recognizing that the absence of EPSS/KEV/POC data means exploitation likelihood cannot be quantified from the inputs and should be re-checked against the 3DS advisory and NVD.

An attacker who holds or registers a low-privilege account on a Tuleap Enterprise Edition instance (17.0-17.5) submits crafted input to a vulnerable server-side feature that passes it unsanitized to an OS command, causing the server to execute attacker-controlled commands under the web application's service account. No public exploit code was identified at time of analysis, and no user interaction is required once the attacker is authenticated.