CVE-2026-92860CWE-20

CVE-2026-92860

Critical · published September 17, 2026

CVSS v3.1
9.1
EPSS
1%
Percentile
57.9
In the wild
Unconfirmed
What it is

A security flaw has been discovered in rcourtman Pulse up to 6.0.4/6.1.0-rc.4. Affected by this issue is the function fmt.Sprintf of the file /api/security/quick-setup of the component Quick Security Setup Handler. The manipulation of the argument Username results in improper input validation. The attack may be performed from remote. Upgrading the affected component is advised.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
9.4 · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X
EPSS
0.00853 · 57.9th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2026-09-17T16:18Z
References (8)
https://github.com/rcourtman/Pulse/ · [email protected]https://github.com/rcourtman/Pulse/releases/tag/v6.1.0 · [email protected]https://github.com/rcourtman/Pulse/security/advisories/GHSA-rr3f-jjrr-3qxv · [email protected]https://vuldb.com/cve/CVE-2026-92860 · [email protected]https://vuldb.com/submit/941807 · [email protected]https://vuldb.com/vuln/406309 · [email protected]https://vuldb.com/vuln/406309/cti · [email protected]https://github.com/rcourtman/Pulse/security/advisories/GHSA-rr3f-jjrr-3qxv · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 19 SEP 03:55Z
    EPSS moved — → 0%
    epss
  • 17 SEP 12:00Z
    rcourtman Pulse Quick Security Setup quick-setup fmt.Sprintf input validation
    cvelistv5