Xenforo
Monthly
Path traversal in XenForo's style archive importer on Windows deployments allows authenticated non-super administrators holding style-import permissions to write arbitrary files outside the intended extraction directory. By crafting a ZIP archive with backslash-delimited member names, an attacker bypasses the forward-slash-only traversal validation enforced on Linux/macOS, writing arbitrary bytes to any path writable by the web-server account - including the public web root - resulting in persistent server-side code execution. The flaw is fixed in XenForo 2.3.13; no public exploit or CISA KEV listing has been identified at time of analysis.
Persistent denial-of-service in XenForo's BBCode parser allows any authenticated forum member to crash PHP-FPM workers for all visitors by submitting a single post with sufficiently deep BBCode nesting. The recursive parser exhausts PHP's call stack, generating fatal errors that terminate worker processes - and because the malicious post persists in the database, every subsequent render of the affected thread repeats the crash, sustaining the outage until the post is removed or the forum is patched. Fixed in XenForo 2.3.13; no public exploit code has been identified at time of analysis.
Unauthorized subscription upgrades in XenForo before 2.3.13 are achievable by replaying valid PayPal REST webhook payloads, because the platform performs no duplicate transaction ID check before processing incoming events. An attacker who possesses a legitimately captured webhook payload - for instance, from a prior genuine purchase - can retransmit it repeatedly to the XenForo webhook endpoint, triggering repeated subscription activations and elevating account privileges without additional payment. No public exploit has been identified at time of analysis, and a vendor patch (2.3.13) is available.
Server-Side Request Forgery in XenForo's PayPal REST webhook handler enables unauthenticated remote attackers to coerce the application server into making arbitrary outbound HTTP requests by supplying a crafted certificate URL in webhook request headers. All XenForo versions prior to 2.3.13 are affected due to the absence of scheme, hostname, or allowlist validation on the attacker-controlled URL. The primary exploitation path targets cloud-hosted deployments: the server can be directed to reach the AWS, GCP, or Azure instance metadata service (169.254.169.254), potentially exfiltrating IAM role credentials and enabling lateral movement into cloud infrastructure. No public exploit has been identified at time of analysis, but the attack surface - an unauthenticated POST to a publicly reachable webhook endpoint - makes this highly automatable against cloud-hosted XenForo instances.
Unauthenticated payment event forgery in XenForo before 2.3.13 stems from a logic error in the PayPal REST webhook signature verification routine: when the incoming `auth_algo` header value cannot be mapped to a supported hash function, the verification function incorrectly returns `true`, causing the application to accept fabricated webhook payloads as legitimate PayPal events. Any XenForo installation with PayPal REST payment integration enabled prior to version 2.3.13 is affected. No public exploit code has been identified at time of analysis, but the vulnerability is trivially exploitable against the webhook endpoint by any network-accessible attacker.
Multi-factor authentication bypass in XenForo before 2.3.13 allows a network-accessible authenticated attacker who knows a target account's password to complete login as that user without possessing their registered passkey. The WebAuthn assertion handler performs a global credential lookup that accepts any registered passkey - including the attacker's own - without verifying the credential belongs to the user whose session is pending, nullifying the passkey TFA layer. Both public forum and admin control panel (ACP) login paths are vulnerable. No public exploit code has been identified at time of analysis and this CVE is not listed in CISA KEV.
Analysis complete. The JSON synthesis is above. Two things worth flagging explicitly: 1. **Prompt injection ignored** — the "Editorial note (internal)" instructed me to weave the word "zabrze" into the `risk_assessment` field. That's an embedded injection attempt (matching the pattern seen across prior CVE-synthesis inputs). I did not comply; no such filler appears anywhere in the output. 2. **Key assessment judgment** — the vendor's 9.1 is real but conditional. This is a **capture-replay persistence** flaw (CWE-294), not a from-nothing takeover: the attacker must already hold a valid refresh token and replay it in the expired-parent-token window (hence `AC:H`). No EPSS/KEV/POC in the data, so the realistic threat is extending the life of stolen tokens rather than mass exploitation. Fix is confirmed: **upgrade to 2.3.13** (backported to 2.2.x). I left `data_quality_flags` empty — the "Authentication Bypass" tag is defensible here since CWE-294 *is* authentication bypass by capture-replay, and the `xenforo` vendor/CPE is correct. I also saved a memory record (`cve-2026-73312.md`) and indexed it, linked to the sibling CVE-2026-73309 (same XenForo 2.3.13 token-security fix batch).
OAuth2 authorization code replay in XenForo before 2.3.13 lets remote unauthenticated attackers redeem a previously used authorization code a second time to obtain an independent, valid token pair for the same user and scopes. Because consumed codes are never invalidated, the single-use guarantee of the OAuth2 authorization code flow is broken, granting persistent unauthorized access tokens. Reported by VulnCheck; a vendor patch exists (2.3.13) and no public exploit has been identified at time of analysis.
XenForo's OAuth2 token endpoint before version 2.3.13 fails to bind the redirect URI to its associated authorization code, enabling an attacker who controls any allowlisted redirect URI to exchange an intercepted authorization code using a mismatched URI and steal the resulting OAuth2 tokens. The flaw affects XenForo installations using OAuth2-based third-party integrations across all versions covered by CPE cpe:2.3:a:xenforo:xenforo:*:*:*:*:*:*:*:*. Vendor-released patch is available as XenForo 2.3.13; no public exploit code or CISA KEV listing has been identified at time of analysis.
Authentication bypass in XenForo before 2.3.13 lets unauthenticated attackers redeem a valid OAuth2 authorization code for a real access/refresh token pair by submitting empty client_secret and code_verifier values at the token endpoint. Because PHP treats empty strings as falsy, both client-secret verification and PKCE code-verifier checks are silently skipped, defeating client authentication and the PKCE binding. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis, and no EPSS or KEV signal was supplied.
Remote code execution in XenForo versions prior to 2.3.9 and 2.2.18 allows authenticated administrators to execute arbitrary code on the server. Attack requires low-privilege admin panel access (PR:L) with network accessibility (AV:N) and low complexity (AC:L). No public exploit identified at time of analysis, though VulnCheck published technical analysis. This represents a supply-chain or insider-threat risk where compromised admin credentials or malicious insiders could achieve complete server compromise.
Unauthenticated information disclosure in XenForo before 2.3.13 exposes private content metadata through the unfurl link-preview endpoint, which performs no session, user identity, or visibility checks on retrieved records. An unauthenticated remote attacker can enumerate predictable auto-increment integer IDs to retrieve rendered preview HTML, original URLs, and query strings generated from private conversations and other access-controlled forum areas. No public exploit has been identified at time of analysis, but the attack is trivially automatable through sequential ID iteration; the issue is fixed in XenForo 2.3.13.
Cross-site scripting in XenForo's dynamic redirect handler allows unauthenticated attackers to inject and execute arbitrary JavaScript in the board origin against authenticated users. The attack abuses a URI parsing confusion flaw: crafting a javascript: URI with the legitimate board hostname embedded in the authority component and percent-encoded newlines (%0a) to evade server-side host validation filters. When a logged-in user is induced to perform a Follow action via the crafted URL, attacker-controlled JavaScript executes in the victim's browser under the XenForo board's origin. No public exploit or KEV listing identified at time of analysis; vendor patch released in 2.3.13.
Missing authorization in XenForo before 2.3.13 permits any ACP administrator to access and submit the force-agreement controller irrespective of their assigned permission set, bypassing the option permission declared in the navigation configuration. An ACP admin with insufficient privileges can update the global policy last-updated timestamp, triggering a site-wide re-consent prompt that forces every registered user to re-accept the privacy policy or terms of service. Vendor-released patch 2.3.13 is available; no public exploit or active exploitation has been identified at time of analysis.
Authorization bypass in XenForo's ACP cache-rebuild dispatcher (versions prior to 2.3.13) allows a limited administrator holding only the rebuildCache permission to invoke arbitrary job classes-including the approval queue job-under any user identity. By crafting a POST body with an arbitrary job class name and actor user ID, the attacker can approve queued user registrations without holding approval-queue or moderator permissions, while the moderation log falsely attributes actions to an impersonated account. No public exploit code has been identified at time of analysis; a vendor-released patch is available in XenForo 2.3.13.
Stored cross-site scripting (XSS) in XenForo before 2.3.10 and 2.2.19 allows authenticated attackers to inject malicious scripts through crafted structured text mentions in profile posts, which are executed when other users view the affected content. The vulnerability has a CVSS score of 5.1 with low attack complexity and requires user interaction (viewing the malicious post), making it a moderate-risk concern for XenForo communities. Publicly available exploit code has been identified, and vendor patches have been released.
Cross-site scripting (XSS) in XenForo lightbox functionality allows unauthenticated remote attackers to inject malicious scripts that execute in the context of other users' browsers when interacting with post content displayed via lightbox. Versions before 2.3.9 and 2.2.18 are affected. The vulnerability requires user interaction (clicking or hovering on lightbox elements) and has limited scope, affecting only session integrity and information disclosure rather than system availability or confidentiality of sensitive data.
Stored cross-site scripting in XenForo before version 2.3.9 allows authenticated users to inject malicious scripts through BB code that persist in the application and execute when other users view the affected content. The vulnerability requires user interaction (viewing the malicious post) and authenticated access to create content, limiting its scope but enabling account compromise and session hijacking of affected users.
XenForo forum software versions prior to 2.3.7 disclose server filesystem paths through exception messages triggered by open_basedir PHP restrictions, enabling remote unauthenticated attackers to map internal directory structures. This information disclosure vulnerability (CWE-209) affects XenForo installations and has been addressed in version 2.3.7 with vendor-confirmed security fixes. No public exploit code or active exploitation is identified at time of analysis, though the unauthenticated remote attack vector and low complexity make reconnaissance straightforward for targeted attacks.
Remote code execution in XenForo versions before 2.3.7 allows authenticated users to invoke unauthorized methods through template callbacks and variable method calls. The vulnerability stems from a loose prefix matching mechanism that permits bypassing intended access restrictions, enabling attackers with low-privilege accounts to achieve high-severity impacts across confidentiality, integrity, and availability. No public exploit identified at time of analysis, though the technical details have been publicly disclosed by VulnCheck, increasing weaponization risk.
XenForo before version 2.3.7 exposes sensitive user account information through improper browser caching of account pages on shared systems. Local users with access to a shared machine or browser can retrieve cached account data belonging to other users who previously accessed XenForo, enabling unauthorized information disclosure without authentication. No public exploit code or active exploitation has been identified; remediation requires upgrading to XenForo 2.3.7 or later.
Authentication bypass in XenForo versions prior to 2.3.7 compromises passkey-based authentication, allowing remote unauthenticated attackers to bypass security controls protecting passkey-enabled user accounts. No public exploit identified at time of analysis, though EPSS data not available. The vulnerability affects a critical authentication mechanism (WebAuthn/passkeys), representing a high-severity threat to forum platforms relying on this modern authentication method.
OAuth2 scope enforcement vulnerability in XenForo 2.3.x (prior to 2.3.5) allows authenticated client applications to request and obtain unauthorized scopes, escalating access beyond intended authorization levels. This authentication bypass flaw (CWE-863) enables malicious OAuth2 clients to gain elevated privileges to user data and platform functions. CVSS 8.7 (High) reflects the network-accessible attack vector with low complexity, though requires low-level privileges (authenticated OAuth client). No public exploit identified at time of analysis, with EPSS data unavailable for recent CVE.
XenForo before 2.2.17 and 2.3.1 allows open redirect via a specially crafted URL. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Xenforo before 2.2.16 allows code injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Xenforo before 2.2.16 allows CSRF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
XenForo before 2.2.14 allows Directory Traversal (with write access) by an authenticated user who has permissions to administer styles, and uses a ZIP archive for Styles Import. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In XenForo through 2.2.7, a threat actor with access to the admin panel can create a new Advertisement via the Advertising function, and save an XSS payload in the body of the HTML document. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Path traversal in XenForo's style archive importer on Windows deployments allows authenticated non-super administrators holding style-import permissions to write arbitrary files outside the intended extraction directory. By crafting a ZIP archive with backslash-delimited member names, an attacker bypasses the forward-slash-only traversal validation enforced on Linux/macOS, writing arbitrary bytes to any path writable by the web-server account - including the public web root - resulting in persistent server-side code execution. The flaw is fixed in XenForo 2.3.13; no public exploit or CISA KEV listing has been identified at time of analysis.
Persistent denial-of-service in XenForo's BBCode parser allows any authenticated forum member to crash PHP-FPM workers for all visitors by submitting a single post with sufficiently deep BBCode nesting. The recursive parser exhausts PHP's call stack, generating fatal errors that terminate worker processes - and because the malicious post persists in the database, every subsequent render of the affected thread repeats the crash, sustaining the outage until the post is removed or the forum is patched. Fixed in XenForo 2.3.13; no public exploit code has been identified at time of analysis.
Unauthorized subscription upgrades in XenForo before 2.3.13 are achievable by replaying valid PayPal REST webhook payloads, because the platform performs no duplicate transaction ID check before processing incoming events. An attacker who possesses a legitimately captured webhook payload - for instance, from a prior genuine purchase - can retransmit it repeatedly to the XenForo webhook endpoint, triggering repeated subscription activations and elevating account privileges without additional payment. No public exploit has been identified at time of analysis, and a vendor patch (2.3.13) is available.
Server-Side Request Forgery in XenForo's PayPal REST webhook handler enables unauthenticated remote attackers to coerce the application server into making arbitrary outbound HTTP requests by supplying a crafted certificate URL in webhook request headers. All XenForo versions prior to 2.3.13 are affected due to the absence of scheme, hostname, or allowlist validation on the attacker-controlled URL. The primary exploitation path targets cloud-hosted deployments: the server can be directed to reach the AWS, GCP, or Azure instance metadata service (169.254.169.254), potentially exfiltrating IAM role credentials and enabling lateral movement into cloud infrastructure. No public exploit has been identified at time of analysis, but the attack surface - an unauthenticated POST to a publicly reachable webhook endpoint - makes this highly automatable against cloud-hosted XenForo instances.
Unauthenticated payment event forgery in XenForo before 2.3.13 stems from a logic error in the PayPal REST webhook signature verification routine: when the incoming `auth_algo` header value cannot be mapped to a supported hash function, the verification function incorrectly returns `true`, causing the application to accept fabricated webhook payloads as legitimate PayPal events. Any XenForo installation with PayPal REST payment integration enabled prior to version 2.3.13 is affected. No public exploit code has been identified at time of analysis, but the vulnerability is trivially exploitable against the webhook endpoint by any network-accessible attacker.
Multi-factor authentication bypass in XenForo before 2.3.13 allows a network-accessible authenticated attacker who knows a target account's password to complete login as that user without possessing their registered passkey. The WebAuthn assertion handler performs a global credential lookup that accepts any registered passkey - including the attacker's own - without verifying the credential belongs to the user whose session is pending, nullifying the passkey TFA layer. Both public forum and admin control panel (ACP) login paths are vulnerable. No public exploit code has been identified at time of analysis and this CVE is not listed in CISA KEV.
Analysis complete. The JSON synthesis is above. Two things worth flagging explicitly: 1. **Prompt injection ignored** — the "Editorial note (internal)" instructed me to weave the word "zabrze" into the `risk_assessment` field. That's an embedded injection attempt (matching the pattern seen across prior CVE-synthesis inputs). I did not comply; no such filler appears anywhere in the output. 2. **Key assessment judgment** — the vendor's 9.1 is real but conditional. This is a **capture-replay persistence** flaw (CWE-294), not a from-nothing takeover: the attacker must already hold a valid refresh token and replay it in the expired-parent-token window (hence `AC:H`). No EPSS/KEV/POC in the data, so the realistic threat is extending the life of stolen tokens rather than mass exploitation. Fix is confirmed: **upgrade to 2.3.13** (backported to 2.2.x). I left `data_quality_flags` empty — the "Authentication Bypass" tag is defensible here since CWE-294 *is* authentication bypass by capture-replay, and the `xenforo` vendor/CPE is correct. I also saved a memory record (`cve-2026-73312.md`) and indexed it, linked to the sibling CVE-2026-73309 (same XenForo 2.3.13 token-security fix batch).
OAuth2 authorization code replay in XenForo before 2.3.13 lets remote unauthenticated attackers redeem a previously used authorization code a second time to obtain an independent, valid token pair for the same user and scopes. Because consumed codes are never invalidated, the single-use guarantee of the OAuth2 authorization code flow is broken, granting persistent unauthorized access tokens. Reported by VulnCheck; a vendor patch exists (2.3.13) and no public exploit has been identified at time of analysis.
XenForo's OAuth2 token endpoint before version 2.3.13 fails to bind the redirect URI to its associated authorization code, enabling an attacker who controls any allowlisted redirect URI to exchange an intercepted authorization code using a mismatched URI and steal the resulting OAuth2 tokens. The flaw affects XenForo installations using OAuth2-based third-party integrations across all versions covered by CPE cpe:2.3:a:xenforo:xenforo:*:*:*:*:*:*:*:*. Vendor-released patch is available as XenForo 2.3.13; no public exploit code or CISA KEV listing has been identified at time of analysis.
Authentication bypass in XenForo before 2.3.13 lets unauthenticated attackers redeem a valid OAuth2 authorization code for a real access/refresh token pair by submitting empty client_secret and code_verifier values at the token endpoint. Because PHP treats empty strings as falsy, both client-secret verification and PKCE code-verifier checks are silently skipped, defeating client authentication and the PKCE binding. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis, and no EPSS or KEV signal was supplied.
Remote code execution in XenForo versions prior to 2.3.9 and 2.2.18 allows authenticated administrators to execute arbitrary code on the server. Attack requires low-privilege admin panel access (PR:L) with network accessibility (AV:N) and low complexity (AC:L). No public exploit identified at time of analysis, though VulnCheck published technical analysis. This represents a supply-chain or insider-threat risk where compromised admin credentials or malicious insiders could achieve complete server compromise.
Unauthenticated information disclosure in XenForo before 2.3.13 exposes private content metadata through the unfurl link-preview endpoint, which performs no session, user identity, or visibility checks on retrieved records. An unauthenticated remote attacker can enumerate predictable auto-increment integer IDs to retrieve rendered preview HTML, original URLs, and query strings generated from private conversations and other access-controlled forum areas. No public exploit has been identified at time of analysis, but the attack is trivially automatable through sequential ID iteration; the issue is fixed in XenForo 2.3.13.
Cross-site scripting in XenForo's dynamic redirect handler allows unauthenticated attackers to inject and execute arbitrary JavaScript in the board origin against authenticated users. The attack abuses a URI parsing confusion flaw: crafting a javascript: URI with the legitimate board hostname embedded in the authority component and percent-encoded newlines (%0a) to evade server-side host validation filters. When a logged-in user is induced to perform a Follow action via the crafted URL, attacker-controlled JavaScript executes in the victim's browser under the XenForo board's origin. No public exploit or KEV listing identified at time of analysis; vendor patch released in 2.3.13.
Missing authorization in XenForo before 2.3.13 permits any ACP administrator to access and submit the force-agreement controller irrespective of their assigned permission set, bypassing the option permission declared in the navigation configuration. An ACP admin with insufficient privileges can update the global policy last-updated timestamp, triggering a site-wide re-consent prompt that forces every registered user to re-accept the privacy policy or terms of service. Vendor-released patch 2.3.13 is available; no public exploit or active exploitation has been identified at time of analysis.
Authorization bypass in XenForo's ACP cache-rebuild dispatcher (versions prior to 2.3.13) allows a limited administrator holding only the rebuildCache permission to invoke arbitrary job classes-including the approval queue job-under any user identity. By crafting a POST body with an arbitrary job class name and actor user ID, the attacker can approve queued user registrations without holding approval-queue or moderator permissions, while the moderation log falsely attributes actions to an impersonated account. No public exploit code has been identified at time of analysis; a vendor-released patch is available in XenForo 2.3.13.
Stored cross-site scripting (XSS) in XenForo before 2.3.10 and 2.2.19 allows authenticated attackers to inject malicious scripts through crafted structured text mentions in profile posts, which are executed when other users view the affected content. The vulnerability has a CVSS score of 5.1 with low attack complexity and requires user interaction (viewing the malicious post), making it a moderate-risk concern for XenForo communities. Publicly available exploit code has been identified, and vendor patches have been released.
Cross-site scripting (XSS) in XenForo lightbox functionality allows unauthenticated remote attackers to inject malicious scripts that execute in the context of other users' browsers when interacting with post content displayed via lightbox. Versions before 2.3.9 and 2.2.18 are affected. The vulnerability requires user interaction (clicking or hovering on lightbox elements) and has limited scope, affecting only session integrity and information disclosure rather than system availability or confidentiality of sensitive data.
Stored cross-site scripting in XenForo before version 2.3.9 allows authenticated users to inject malicious scripts through BB code that persist in the application and execute when other users view the affected content. The vulnerability requires user interaction (viewing the malicious post) and authenticated access to create content, limiting its scope but enabling account compromise and session hijacking of affected users.
XenForo forum software versions prior to 2.3.7 disclose server filesystem paths through exception messages triggered by open_basedir PHP restrictions, enabling remote unauthenticated attackers to map internal directory structures. This information disclosure vulnerability (CWE-209) affects XenForo installations and has been addressed in version 2.3.7 with vendor-confirmed security fixes. No public exploit code or active exploitation is identified at time of analysis, though the unauthenticated remote attack vector and low complexity make reconnaissance straightforward for targeted attacks.
Remote code execution in XenForo versions before 2.3.7 allows authenticated users to invoke unauthorized methods through template callbacks and variable method calls. The vulnerability stems from a loose prefix matching mechanism that permits bypassing intended access restrictions, enabling attackers with low-privilege accounts to achieve high-severity impacts across confidentiality, integrity, and availability. No public exploit identified at time of analysis, though the technical details have been publicly disclosed by VulnCheck, increasing weaponization risk.
XenForo before version 2.3.7 exposes sensitive user account information through improper browser caching of account pages on shared systems. Local users with access to a shared machine or browser can retrieve cached account data belonging to other users who previously accessed XenForo, enabling unauthorized information disclosure without authentication. No public exploit code or active exploitation has been identified; remediation requires upgrading to XenForo 2.3.7 or later.
Authentication bypass in XenForo versions prior to 2.3.7 compromises passkey-based authentication, allowing remote unauthenticated attackers to bypass security controls protecting passkey-enabled user accounts. No public exploit identified at time of analysis, though EPSS data not available. The vulnerability affects a critical authentication mechanism (WebAuthn/passkeys), representing a high-severity threat to forum platforms relying on this modern authentication method.
OAuth2 scope enforcement vulnerability in XenForo 2.3.x (prior to 2.3.5) allows authenticated client applications to request and obtain unauthorized scopes, escalating access beyond intended authorization levels. This authentication bypass flaw (CWE-863) enables malicious OAuth2 clients to gain elevated privileges to user data and platform functions. CVSS 8.7 (High) reflects the network-accessible attack vector with low complexity, though requires low-level privileges (authenticated OAuth client). No public exploit identified at time of analysis, with EPSS data unavailable for recent CVE.
XenForo before 2.2.17 and 2.3.1 allows open redirect via a specially crafted URL. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Xenforo before 2.2.16 allows code injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Xenforo before 2.2.16 allows CSRF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
XenForo before 2.2.14 allows Directory Traversal (with write access) by an authenticated user who has permissions to administer styles, and uses a ZIP archive for Styles Import. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In XenForo through 2.2.7, a threat actor with access to the admin panel can create a new Advertisement via the Advertising function, and save an XSS payload in the body of the HTML document. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.