type: cve · created: 2026-10-20 · updated: 2026-10-20 · tags: [cve] · confidence: medium · severity: critical · affected_sectors: [global] · au_impact: false
Chained with it, CVE-2026-107187 (CVSS 8.5) reads arbitrary database tables through the AbCommonResources-getDataRecords workflow — Rapid7 extracted user names and passwords from the afm_users table — while CVE-2026-107188 (CVSS 9.6, critical) allows JSP/JSPX uploads via export reports, yielding command execution as NT AUTHORITY\Local Service.
| Attribute | Detail |
|---|---|
| CVE | CVE-2026-107188 |
| CVSS | 9.6 (CRITICAL) |
| Vendor / product | Not stated |
| Reported | 2026-10-20 |