What’s Vulnerable › Vulnerabilities
CVE-2026-32989: Precurio Intranet Portal 4.4: Cross-Site Request Forgery leading to arbitrary file upload
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2026-03-20 · updated 2026-10-29
- Weakness: CWE-352
Description
Precurio Intranet Portal 4.4 contains a cross-site request forgery vulnerability that allows attackers to induce authenticated users to submit crafted requests to a profile update endpoint handling file uploads. Attackers can exploit this to upload executable files to web-accessible locations, leading to arbitrary code execution in the context of the web server.
Affected products
References
Get alerted when CVE-2026-32989 or the next vulnerability affects your stack