What’s Vulnerable › Vulnerabilities
CVE-2026-8590: Spotfire OAuth2 PKCE Bypass for public clients
- Severity: high (CVSS 8.7 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-07-14 · updated 2026-07-15
Description
Vulnerability in Spotfire Spotfire Enterprise (Spotfire Server modules), Spotfire Spotfire Enterprise with External Consumers (Spotfire Server modules), Spotfire Spotfire on Kubernetes (Spotfire Server modules). This issue affects Spotfire Enterprise: through 14.0.12, through 14.4.2, through 14.5.0, through 14.6.1, through 14.6.2, through 14.7.0, through 14.8.0; Spotfire Enterprise with External Consumers: through 14.0.12, through 14.5.0, through 14.6.0, through 14.6.1, through 14.6.2, through 14.7.0, through 14.8.0; Spotfire on Kubernetes: through 4.2.0, 5.0.X, 6.0.X.
Affected products
- Spotfire Enterprise: through 14.0.12; through 14.4.2; through 14.5.0; through 14.6.1; through 14.6.2; through 14.7.0
- Spotfire Enterprise with External Consumers: through 14.0.12; through 14.5.0; through 14.6.0; through 14.6.1; through 14.6.2; through 14.7.0
- Spotfire on Kubernetes: through 4.2.0; 5.0.x, 6.0.x
References
Get alerted when CVE-2026-8590 or the next vulnerability affects your stack