CVE-2026-35056 HIGH

CVE-2026-35056: XenForo Remote Code Execution via Authenticated Admin

Vendor Xenforo
Product XenForo
Weakness CWE-94 · Code injection
Published April 1, 2026
Last update May 25, 2026
View on NVD All CVEs

CVSS base score

8.6/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

XenForo before 2.3.9 and before 2.2.18 allows remote code execution (RCE) by authenticated, but malicious, admin users. An attacker with admin panel access can execute arbitrary code on the server.

Key dates

02Disclosure timeline

April 1, 2026 CVE published
May 25, 2026 Record updated