Security feed

24 October 2026

advisoryHighOfficial CVE List24 Oct 2026

CVE-2026-7395

Asset Suite allows unauthenticated users to access HTTPPublishAdapterTestServlet that can be used for configuration file upload, leading to information disclosure and integrity compromise. The HTTPPublishAdapterTestServlet is specifically meant for testing purposes to be used in a non-production environment.

Announced 29 Sept 2026

Asset Suite CVE-2026-7395

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-7395

Asset Suite

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-7395
Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event: #3487 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:36:04 GMT
Publisher date: Tue, 29 Sep 2026 09:45:11 GMT

Read the original announcement

advisoryMediumOfficial CVE List24 Oct 2026

CVE-2026-11796

Asset Suite allows unauthenticated users to access PropertiesReloadServlet, CacheFlushServlet, MetadataCacheFlushServlet and ResourceBundleReloadServlet, which could result in denial-of-service conditions affecting application availability. These servlets are designed to perform specific functions within production environment depending on how the Asset Suite application is configured.