CVE-2026-84285: OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.3 through 17.5

Q: What level of access does an attacker need to exploit this issue?

The CVSS vector indicates that an attacker needs low-level privileges (PR:L). No user interaction is required, and the attack can be performed over the network.

Q: What is the potential impact of successful exploitation?

Successful exploitation could allow arbitrary command execution on the server. The reported impact includes high confidentiality, integrity, and availability impact.

Q: Which installations should be prioritized for remediation?

Tuleap Enterprise Edition installations running versions 17.3 through 17.5 are identified as affected. Network-accessible deployments should be prioritized because the attack vector is network-based.

Published Sep 21, 2026

Updated

An OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.3 through 17.5 could allow an attacker to execute arbitrary commands on the server.

Affected Software

1 affected component

Tuleap Enterprise Edition>=17.3<=17.5

Event History

Sep 21, 2026

CVE Published

via MITRE·12:07 PM

Data Sourced

via MITRE·12:07 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The CVSS vector indicates that an attacker needs low-level privileges (PR:L). No user interaction is required, and the attack can be performed over the network.

What is the potential impact of successful exploitation?

Successful exploitation could allow arbitrary command execution on the server. The reported impact includes high confidentiality, integrity, and availability impact.

Which installations should be prioritized for remediation?