CVE-2026-115731

{
  "etk_id": "ETK-2026-3407",
  "cve_id": "CVE-2026-115731",
  "display_id": "CVE-2026-115731",
  "ghsa_id": null,
  "euvd_id": "EUVD-2026-116495",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unsafe report deserialization in Puppet Enterprise",
  "summary": "Affected Puppet Enterprise releases process report data through unsafe deserialization. A client with a CA-signed agent certificate can execute code as the Puppet Server service account; weak certificate autosigning can enable an unauthenticated network attacker to obtain the required certificate.",
  "mitigation": "Upgrade Puppet Enterprise to 2023.8.13, 2025.12.1, or 2026.0.1, as appropriate for your release stream. Until upgraded, disable or tightly restrict certificate autosigning and allow report submission only from verified agent identities.",
  "vendor": "Perforce",
  "product": "Puppet Enterprise",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 2023.8.0, < 2023.8.13",
        ">= 2025.0.0, < 2025.12.1",
        ">= 2026.0.0, < 2026.0.1"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "2023.8.13",
        "2025.12.1",
        "2026.0.1"
      ],
      "package_name": "Puppet Enterprise",
      "purl": null
    }
  ],
  "cwes": [
    502
  ],
  "cvss_score": 9.4,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 86.00547086666667,
  "t0_at": "2026-11-03T20:40:10.100000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-03T20:40:10.100000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-03T20:40:10.100000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-115731"
    }
  }
}