Loading story…
National cybersecurity authorities warned of a critical vulnerability in MISP (Malware Information Sharing Platform), affecting versions prior to v2.5.39. Belgium's Centre for Cybersecurity issued an urgent advisory telling organizations to patch immediately, while Canada's Centre for Cyber Security said MISP had published a security advisory covering the flaws and identified v2.5.39 as the fixed release.
The notices urge administrators and users running vulnerable MISP deployments to review the vendor's advisory and apply the update without delay. Organizations using MISP for threat-intelligence sharing face elevated risk until systems are upgraded, making prompt remediation and verification of deployed versions a priority.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security issued notice AV26-565 advising users and administrators to review MISP's advisory materials and apply the necessary updates for affected versions prior to v2.5.39. The notice points to MISP version 2.5.39 as the relevant updated release.
The Centre for Cybersecurity Belgium published an advisory warning of a critical vulnerability in MISP and telling users to patch immediately. The reference indicates the warning was published on June 8, 2026.
MISP published a security advisory on June 4, 2026 addressing vulnerabilities affecting MISP versions prior to v2.5.39. The advisory identifies version 2.5.39 as the updated release to remediate the issues.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecyber.gc.ca
Open sourceccb.belgium.be
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Canadian Centre for Cyber Security warned that **MISP 2.5.45 and earlier** are affected by one or more vulnerabilities and urged administrators to apply vendor updates. MISP subsequently released version **2.5.46**, delivering security hardening that includes fixes for sharing-group authorization, outbound-request validation, authentication and session handling, CSRF/XSS protections, logging, throttling, and file-deletion safeguards. A corrected sharing-group validation path now explicitly rejects empty `sharing_group_id` values and verifies that users may use a submitted group, preventing a fail-open condition in which a missing or falsy ID could return the user's full authorized sharing-group list. The release also adds a shared URL egress validator and strengthens the HTTP client to mitigate SSRF exposure through destination restrictions, redirect controls, response-size limits, and TLS peer verification enabled by default; organizations operating MISP should upgrade to **2.5.46** and review vendor guidance.
Sep 11, 2026
The Canadian Centre for Cyber Security warned that **MISP CTI-Transmute** versions `<= 1.4.0` are affected by multiple vulnerabilities, including **CVE-2026-69082** and **CVE-2026-69079`. One flaw allows **cross-site request forgery (CSRF)** against the administrative user-deletion endpoint because `/account/delete/<id>` accepted HTTP `GET` requests for a state-changing action, letting an attacker trick a logged-in administrator into deleting a chosen user account. The issue could cause unauthorized state changes, denial of access for affected users, and potential disruption if administrator accounts are targeted. A second high-severity flaw allows **unauthenticated denial of service** through the `/activity_timeline` endpoint, where an unbounded `days` parameter could be abused to force excessive database, CPU, and memory consumption and degrade site availability. The advisory also referenced remediation for blocking file and network fetches during evaluation PDF rendering, alongside fixes that cap the timeline range and require `POST` plus CSRF protection for user deletion. Administrators were urged to review the linked fixes and apply updates as they become available.
Aug 4, 2026
MISP-related products were flagged for a vulnerability affecting website routes used to query external MISP instances, and CERT-PY published an advisory warning organizations about the issue. The exposed functionality involved the `/fetch_misp_event` and `/misp_search_events` endpoints, which could be reached without authentication and interacted with remote MISP servers, creating risk around unauthorized use and server-side request handling. A corresponding code change in `MISP/cti-transmute` hardened those routes by adding **authentication requirements** and stricter validation of external MISP URLs. The patch now resolves hostnames to all associated IP addresses and rejects targets if any address is not globally routable, blocking access to private, loopback, link-local, or reserved destinations and reducing **SSRF** exposure through DNS names; project notes also state that while DNS rebinding or post-validation DNS changes may still allow limited probing, response bodies remain constrained by TLS hostname validation and disabled redirects.
Aug 11, 2026