CVE-2026-35056: XenForo Remote Code Execution via Authenticated Admin
Published Apr 1, 2026
·Updated
XenForo before 2.3.9 and before 2.2.18 allows remote code execution (RCE) by authenticated, but malicious, admin users. An attacker with admin panel access can execute arbitrary code on the server.
Affected Software
3 affected components
XenForo Xenforo<2.3.9, <2.2.18
XenForo Xenforo<2.2.18
XenForo Xenforo>=2.3.0<2.3.9
Event History
Apr 1, 2026
CVE Published
via MITRE·12:30 AM
Data Sourced
via MITRE·12:30 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·01:16 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-35056?
CVE-2026-35056 has a critical severity rating due to the potential for remote code execution by authenticated admin users.
2
How do I fix CVE-2026-35056?
To mitigate CVE-2026-35056, upgrade to XenForo versions 2.3.9 or 2.2.18 or later.
3
Who exploits CVE-2026-35056?
CVE-2026-35056 can be exploited by attackers who have gained authenticated admin access to the XenForo platform.
4
What are the consequences of CVE-2026-35056?
Exploitation of CVE-2026-35056 can lead to arbitrary code execution on the server, potentially compromising the entire system.
5
What versions of XenForo are affected by CVE-2026-35056?
CVE-2026-35056 affects XenForo versions prior to 2.3.9 and 2.2.18.