Burp Suite Dast
Monthly
Authentication bypass in PortSwigger Burp Suite DAST (formerly Burp Suite Enterprise Edition) before 2026.8 allows unauthenticated remote attackers to reach restricted functionality through an alternate path or channel, yielding high confidentiality, integrity and availability impact on the scanning platform. The CVSS 4.0 base score of 9.2 and CISA SSVC technical impact rating of 'total' reflect complete compromise of the affected management interface, although an undisclosed attack precondition (AT:P) must be satisfied and the product is normally deployed on segmented internal networks rather than being internet-facing. No public exploit identified at time of analysis, and SSVC exploitation is rated 'none', so this is a serious but not currently imminent priority. Authentication requirements are confirmed unauthenticated by the CVSS vector (PR:N, UI:N). Vendor-released patch: 2026.8.
Authentication bypass in PortSwigger Burp Suite DAST (formerly Burp Suite Enterprise Edition) before 2026.8 allows unauthenticated remote attackers to reach restricted functionality through an alternate path or channel, yielding high confidentiality, integrity and availability impact on the scanning platform. The CVSS 4.0 base score of 9.2 and CISA SSVC technical impact rating of 'total' reflect complete compromise of the affected management interface, although an undisclosed attack precondition (AT:P) must be satisfied and the product is normally deployed on segmented internal networks rather than being internet-facing. No public exploit identified at time of analysis, and SSVC exploitation is rated 'none', so this is a serious but not currently imminent priority. Authentication requirements are confirmed unauthenticated by the CVSS vector (PR:N, UI:N). Vendor-released patch: 2026.8.