CVE-2026-888049.6CriticalCWE-79
CVE-2026-88804: Unauthenticated update of public UI settings leading to stored cross-site scripting in Rancher
SUSE · Rancher
Vendor fix available · Affected: SUSE Rancher · Exploitation: public proof of concept (unverified)
ExploitationProof of concept public
Not in CISA KEV as of catalogue 2026.11.13 (13 Nov)
- In CISA KEV: not seen
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public1 public GitHub repository (unverified), listed by PoC-in-GitHub29 Oct
- Not established: not seen
1.0%probability of exploitation in the next 30 days
64th percentile
050100
Higher than 64% of scored CVEs
9.6CriticalCVSS 3.1
LowMediumHighCrit.
DescriptionNVD
An unauthenticated update of public UI settings could be used by remote attackers to execute a stored cross-site scripting attack in the Rancher UI, in SUSE Rancher 2.15 before 2.15.2, 2.14 before 2.14.6, 2.13 before 2.13.10, 2.12 before 2.12.14 and 2.11 before 2.11.18.
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Check available, not yet exploited. A public nuclei template can confirm it on a system you are authorised to test.
- CISA KEV
- Not listed
- Public check
- SUSE Rancher - Stored XSS via Unauthenticated Settings Override · nuclei template in projectdiscovery/nuclei-templates
- Weakness
- Cross-site Scripting
- Vendor
- SUSE
- Published
- September 2026
What changed
- FIRST’s EPSS score rose from 0.4% to 1%, past 1% FIRST
- PoC-in-GitHub lists 1 public GitHub repository (unverified) PoC-in-GitHub
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 24 Sep.
- Critical Flaws Put VeloCloud, BIG-IP and Rancher Systems at RiskSecurityOnline · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.