Perforce Puppet Enterprise vulnerabilities

• perforce puppet enterprise Report Deserialization Code Execution CVE-2026-115731 Fix available 9.4 CriticalNovember 3, 2026
• perforce puppet enterprise Certificate Name Authorization Bypass CVE-2026-115732 Fix available 9.0 CriticalNovember 3, 2026
• perforce puppet enterprise Command Injection in Puppet Enterprise CVE-2026-85979 8.6 HighSeptember 11, 2026
• perforce puppet core, puppet enterprise +1 more Cleartext Storage of Sensitive Information for Puppet Resource API CVE-2026-8804 Fix available 6.7 MediumJuly 3, 2026
• perforce puppet enterprise Insufficiently Protected Credentials in Puppet Enterprise 2025.4 and 2025.5 CVE-2025-10360 6.9 MediumSeptember 24, 2025
• perforce puppet enterprise, puppet enterprise +1 more OS Command Injection CVE-2025-5459 8.6 HighJune 26, 2025
• perforce puppet enterprise, puppet enterprise +1 more Broken Session Management in Puppet Enterprise CVE-2023-5309 6.8 MediumNovember 7, 2023
• puppet server, perforce puppet enterprise, puppet enterprise +2 more Denial of Service for Revocation of Auto Renewed Certificates CVE-2023-5255 4.4 MediumOctober 3, 2023
• perforce puppet enterprise, puppet enterprise +1 more A privilege escalation allowing remote code execution was discovered in the orchestration service. CVE-2023-2530 9.8 CriticalJune 7, 2023
• puppet server, perforce puppet enterprise, puppet enterprise +2 more A Regular Expression Denial of Service (ReDoS) issue was discovered in Puppet Server 7.9.2... CVE-2023-1894 Fix available 5.3 MediumMay 4, 2023
• perforce puppet enterprise, puppet, puppet enterprise +2 more A flaw was discovered in bolt-server and ace where running a task with sensitive parameters... CVE-2021-27022 4.9 MediumSeptember 7, 2021
• perforce puppet enterprise, puppet enterprise +1 more Puppet Enterprise presented a security risk by not sanitizing user input when doing a CSV export. CVE-2021-27020 8.8 HighAugust 30, 2021
• perforce puppet enterprise, puppet server, enterprise +1 more +3 more Puppet Server and PuppetDB provide useful performance and debugging information via their metrics... CVE-2020-7943 Fix available 7.5 HighMarch 11, 2020
• perforce puppet enterprise, puppet enterprise +1 more The express install, which is the suggested way to install Puppet Enterprise, gives the user a... CVE-2019-10694 9.8 CriticalDecember 11, 2019
• perforce puppet enterprise, puppet enterprise +1 more When users are configured to use startTLS with RBAC LDAP, at login time, the user's credentials... CVE-2018-11749 9.8 CriticalAugust 24, 2018
• perforce puppet enterprise, puppet enterprise +1 more XSS Vulnerability in Puppet Enterprise Console CVE-2018-6511 5.4 MediumMay 8, 2018
• perforce puppet enterprise, puppet enterprise +1 more XSS Vulnerability in Puppet Enterprise Console CVE-2018-6510 5.4 MediumMay 8, 2018
• perforce puppet enterprise, puppet enterprise, puppetlabs/apache +4 more +6 more Puppet Enterprise 2017.3.x prior to 2017.3.3 are vulnerable to a remote execution bug when a... CVE-2018-6508 Fix available 8.0 HighFebruary 9, 2018
• perforce puppet enterprise, puppet, puppet agent +3 more +5 more In previous versions of Puppet Agent it was possible for the agent to retrieve facts from an... CVE-2017-10690 6.5 MediumFebruary 9, 2018
• perforce puppet enterprise, puppet enterprise +1 more Puppet Enterprise versions prior to 2016.4.5 and 2017.2.1 did not correctly authenticate users... CVE-2017-2297 7.5 HighFebruary 1, 2018
• perforce puppet enterprise, puppet enterprise +1 more In Puppet Enterprise 2017.1.x and 2017.2.1, using specially formatted strings with certain... CVE-2017-2296 6.5 MediumFebruary 1, 2018
• perforce puppet enterprise, puppet enterprise +1 more Versions of Puppet Enterprise prior to 2016.4.5 or 2017.2.1 shipped with an MCollective... CVE-2017-2293 4.9 MediumFebruary 1, 2018
• puppet, puppet agent, puppetpu puppet agent +4 more +6 more Tarball permission preservation in puppet CVE-2017-10689 Fix available 5.5 MediumDecember 31, 2017
• perforce puppet enterprise, puppet enterprise +1 more The console in Puppet Enterprise 2015.x and 2016.x prior to 2016.4.0 includes unsafe string reads... CVE-2016-5716 8.8 HighAugust 9, 2017
• perforce puppet enterprise, puppet enterprise +1 more Versions of Puppet Enterprise prior to 2016.4.5 or 2017.2.1 failed to mark MCollective server... CVE-2017-2294 7.5 HighJuly 5, 2017
• perforce puppet enterprise, puppet enterprise +1 more The Puppet Communications Protocol (PCP) Broker incorrectly validates message header sizes. An... CVE-2016-9686 5.3 MediumFebruary 8, 2017