Loading vulnerability…
Authenticated Admin RCE in XenForo
CVE-2026-35056 is a remote code execution vulnerability affecting XenForo before version 2.3.9 and XenForo 2.2.x before 2.2.18. According to the provided content, the issue is exploitable by an authenticated but malicious administrator with access to the XenForo admin panel, allowing arbitrary code execution on the underlying server. The supplied classification maps the issue to CWE-94, indicating improper control of code generation or execution. No additional vulnerable function or code path details were provided in the available content.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation results in arbitrary code execution on the XenForo server. Because the attacker can run code on the host, the impact is effectively full compromise of the application and potentially the underlying system, including unauthorized access to sensitive data, modification of application state and content, deployment of persistent backdoors or malware, and disruption of service availability. The provided CVSS vectors indicate high impact to confidentiality, integrity, and availability.
If you can’t patch tonight, do this now.
If immediate patching is not possible, restrict and closely audit administrator access to the XenForo admin panel, reduce the number of accounts with administrative privileges, enforce strong authentication for admin users, and monitor for suspicious administrative actions or unexpected server-side code execution. Because exploitation requires admin access, limiting exposure of the admin interface and reviewing privileged accounts may reduce risk, but patching is the definitive fix.
Patch, then assume compromise.
Upgrade XenForo to a fixed release. The provided content indicates that versions 2.3.9 and 2.2.18 contain the security fix. Organizations should update affected XenForo installations to 2.3.9 or later, or to 2.2.18 or later on the 2.2 branch, following XenForo’s security release guidance.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.