CVE-2026-115731
Report Deserialization Code Execution
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Deserialization of untrusted data in the report-processing code of Puppet, as used by Puppet Server, in the affected releases, allows a client that holds any CA-signed agent certificate to execute arbitrary code on the Puppet Server as its service user by submitting a report containing a crafted rich-data type via PUT request. Where the certificate authority autosigns requests without strong verification, an unauthenticated network attacker can obtain such a certificate.
| CWE | CWE-502 CWE-94 |
| Vendor | perforce |
| Product | puppet enterprise |
| Published | Nov 3, 2026 |
| Last Updated | Nov 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for perforce puppet enterprise
Be the first to know when new unknown vulnerabilities affecting perforce puppet enterprise are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Perforce / Puppet Enterprise
2023.8.0 < 2023.8.13 2025.0.0 < 2025.12.1 2026.0.0 < 2026.0.1