CVE-2026-88804
An unauthenticated update of public UI settings could be used by remote attackers to execute a…
- Risk score
- 72/100
- CVSS
- 9.6 v3.1
- Exploit chance (30 days)
- 0.6%
- Published
- 28 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- An unauthenticated update of public UI settings could be used by remote attackers to execute a stored cross-site scripting attack in the Rancher UI, in SUSE Rancher 2.15 before 2.15.2, 2.14 before 2.14.6, 2.13 before 2.13.10, 2.12 before 2.12.14 and 2.11 before 2.11.18.
- Affected
- See advisory
- Fix
- Upgrade the product to 2.15.2, 2.14, 2.14.6, 2.13, 2.13.10, 2.12, 2.12.14 or 2.11 (whichever matches your release line), or later.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.6 critical
- Remotely exploitable without logging in
References
Original description
An unauthenticated update of public UI settings could be used by remote attackers to execute a stored cross-site scripting attack in the Rancher UI, in SUSE Rancher 2.15 before 2.15.2, 2.14 before 2.14.6, 2.13 before 2.13.10, 2.12 before 2.12.14 and 2.11 before 2.11.18.
Last activity 28 Sep 2026. Patch Forecast updates every hour.