CVE-2026-35056 - Vulnerability Analysis

Overview

XenForo < 2.3.9 and < 2.2.18 contains a remote code execution caused by malicious input from authenticated admin users, letting attackers with admin panel access execute arbitrary code on the server, exploit requires admin privileges.

Severity & Score

Impact

Authenticated admin users can execute arbitrary code on the server, leading to full system compromise.

Mitigation

Update to version 2.3.9 or 2.2.18 or later.

References

• https://forums.freebsd.org/threads/forum-outage.102193/
• https://www.vulncheck.com/advisories/xenforo-remote-code-execution-via-authenticated-admin
• https://xenforo.com/community/threads/xenforo-2-3-9-inc-xfmg-2-2-18-released-security-fix.235659/

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Apr 1, 2026

🟠 CVE-2026-35056 - High (8.8) XenForo before 2.3.9 and before 2.2.18 allows remote code execution (RCE) by authenticated, but malicious, admin users. An attacker with admin panel access can execute arbitrary code on the server. 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35056/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner