CVE-2026-46491
📛 CVE Title
(no title)
Description
SimpleSAMLphp casserver FileSystemTicketStore path traversal allows out-of-ticket-directory read/unserialize and conditional deletion
Description (MITRE) cveawg.mitre.org
Pulled from cveawg.mitre.org/api/cve/CVE-2026-46491 on 2026-08-25. Shown when MITRE's text differs from the cvelistV5 mirror.
SimpleSAMLphp-casserver is a CAS 1.0 and 2.0 compliant CAS server in the form of a SimpleSAMLphp module. Prior to version 7.0.3, simplesamlphp-module-casserver builds file paths for the file-based CAS ticket store by directly concatenating the configured ticket directory with an attacker-controlled ticket identifier. Public CAS validation/proxy endpoints pass attacker-controlled ticket / pgt query parameters into this store. In deployments using FileSystemTicketStore, a remote attacker can use path traversal sequences such as ../target.serialized to make the CAS server read and unserialize files outside the ticket directory. In the CAS 1.0 validation flow, the same attacker-selected path is also passed to deleteTicket() immediately after getTicket() returns, which can delete the target file when it is readable by the PHP process, deletable under the PHP process filesystem permissions, and unserializes to a value compatible with the ?array return type. This issue has been patched in version 7.0.3.
Overview
- State
- —
- Assigner (CNA)
- —
- CVSS severity
- high
- CVSS score
- 8.6 / 10
- CVSS vector
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L- Effective score
- 8.6 / 10 HIGH source: CNA overview
- CWE(s)
- —
- Reserved
- —
- Published
- —
- Last updated
- —
- Source
- https://www.tenable.com/cve/CVE-2026-46491
- Linked Threat
- CVE-2026-46491 — CVE-2026-46491
NVD / KEV / EPSS data refreshed 2026-05-25 00:07 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2026-35871 - Assigner
- GitHub_M
- Published
- Jun 9, 2026, 11:00:11 PM
- Updated
- Jun 10, 2026, 6:11:30 PM
- EUVD base score (CVSS 3.1)
-
8.6 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L - EUVD-reported EPSS
- 0.4200
- Vendors
- SimpleSAMLphp
- Products
-
simplesamlphp-module-casserver (< 7.0.3)
- Aliases
-
GHSA-jrrg-99xh-5j2q
ENISA description: SimpleSAMLphp-casserver is a CAS 1.0 and 2.0 compliant CAS server in the form of a SimpleSAMLphp module. Prior to version 7.0.3, simplesamlphp-module-casserver builds file paths for the file-based CAS ticket store by directly concatenating the configured ticket directory with an attacker-controlled ticket identifier. Public CAS validation/proxy endpoints pass attacker-controlled ticket / pgt query parameters into this store. In deployments using FileSystemTicketStore, a remote attacker can use path traversal sequences such as ../target.serialized to make the CAS server read and unserialize files outside the ticket directory. In the CAS 1.0 validation flow, the same attacker-selected path is also passed to deleteTicket() immediately after getTicket() returns, which can delete the target file when it is readable by the PHP process, deletable under the PHP process filesystem permissions, and unserializes to a value compatible with the ?array return type. This issue has been patched in version 7.0.3.
EUVD references (3)
Vendor references (0)
References embedded in the original CVE record by the assigning CNA.
None in the CVE record.
MITRE references (3) cveawg.mitre.org
Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.
- https://github.com/simplesamlphp/simplesamlphp-module-casserver/commit/b84f3e4ed57c4d97e0dc73df102e7eff831a681f x_refsource_MISC
- https://github.com/simplesamlphp/simplesamlphp-module-casserver/releases/tag/v7.0.3 x_refsource_MISC
- https://github.com/simplesamlphp/simplesamlphp-module-casserver/security/advisories/GHSA-jrrg-99xh-5j2q x_refsource_CONFIRM
Web references (2)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
- https://nvd.nist.gov/vuln/detail/CVE-2026-46491 tenable:nvd.nist.gov
- https://www.cve.org/CVERecord?id=CVE-2026-46491 tenable:www.cve.org
Remediations (10)
Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.
-
web:blog.gridinsoft.com
Microsoft has confirmed exploitation of two Microsoft Defender vulnerabilities fixed in the May 2026 security update cycle. CVE - 2026 -41091 is an elevation-of-privilege flaw in the Microsoft Malware Protection Engine, while CVE - 2026 -45498 is a denial-of-service flaw in the Microsoft Defender Antimalware Platform . The first bug matters more for incident response because a local authorized ...
2026-05-26 02:55 UTC -
web:cyberpress.org
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two actively exploited Microsoft Defender vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, issuing an urgent remediation directive for federal agencies with a due date of June 3, 2026 .
2026-05-26 02:55 UTC -
web:howtofix.guide
CISA added both CVE - 2026 -41091 and CVE - 2026 -45498 to its Known Exploited Vulnerabilities catalog on May 20, with a federal remediation due date of June 3, 2026 . [4] That KEV entry does not mean every home PC is currently targeted, but it is a clear signal that defenders should not wait for the next normal maintenance window.
2026-05-26 02:55 UTC -
web:support.microsoft.com
The following summary outlines key issues addressed by this update. The bold text within the brackets indicates the item or area of the change. [Networking] Fixed: This update addresses a security issue in the Windows Routing and Remote Access Service (RRAS) management tool. If you connect to a malicious remote server, an attacker could disrupt the tool or run code on your device. For more ...
2026-05-26 02:55 UTC -
web:thecyberexpress.com
Microsoft confirms active exploitation of CVE - 2026 -41091 and CVE - 2026 -45498 in Defender, with CVSS-rated risks, KEV listing, and urgent patches issued.
2026-05-26 02:55 UTC -
web:thehackernews.com
Microsoft has disclosed that a privilege escalation and a denial-of-service flaw in Defender has come under active exploitation in the wild. The former, tracked as CVE - 2026 -41091, is rated 7.8 on the CVSS scoring system. Successful exploitation of the flaw could allow an attacker to gain SYSTEM privileges. "Improper link resolution before file access ('link following') in Microsoft Defender ...
2026-05-26 02:55 UTC -
web:www.archynewsy.com
Understanding the Exploited Vulnerabilities The security risks involve two distinct CVE -tracked flaws that Microsoft has addressed in its latest updates: Critical Microsoft Defender Vulnerabilities Antimalware Platform CVE - 2026 -41091 (CVSS Score: 7.8): This vulnerability involves improper link resolution before file access, commonly known as "link following." By successfully exploiting ...
2026-05-26 02:55 UTC -
web:www.bugcrowd.com
Vulnerability mitigation is typically considered a temporary or interim solution. While mitigation measures can reduce the immediate risk associated with vulnerabilities, they may not provide a permanent fix . Organizations should aim to prioritize and plan for complete vulnerability remediation whenever feasible and allocate resources accordingly.
2026-05-26 02:55 UTC -
web:www.forbes.com
Microsoft has confirmed an emergency security update as CISA warns that two new Defender zero-days are being exploited by attackers.
2026-05-26 02:55 UTC -
web:www.helpnetsecurity.com
Attackers are actively exploiting two Microsoft Defender vulnerabilities ( CVE - 2026 -41091 and CVE - 2026 -45498), Microsoft acknowledged.
2026-05-26 02:55 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.