{"id":"CVE-2026-115731","title":"Report Deserialization Code Execution","summary":"Deserialization of untrusted data in the report-processing code of Puppet, as used by Puppet Server, in the affected releases, allows a client that holds any CA-signed agent certificate to execute arbitrary code on the Puppet Server as i…","severity":"critical","cvss":9.4,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","cvssSource":"cna","cwe":["CWE-502","CWE-94"],"vendor":"Perforce","product":"Puppet Enterprise","affected":["puppet_enterprise >= 2023.8.0 < 2023.8.13","puppet_enterprise >= 2025.0.0 < 2025.12.1","puppet_enterprise >= 2026.0.0 < 2026.0.1"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-11-06T19:36:26.464307Z"},"published":"2026-11-03","updated":"2026-11-06","sourceUpdated":"2026-11-06T19:36:39.577Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-115731","references":[{"url":"https://portal.perforce.com/s/cve/a91Qi000003IaHpIAK/report-deserialization-code-execution"}],"tags":["cve.org"],"epss":0.00366,"epssPercentile":0.30593,"ingestedAt":"2026-11-05T20:33:06.478Z","slug":"CVE-2026-115731","body":"## Overview\n\nDeserialization of untrusted data in the report-processing code of Puppet, as used by Puppet Server, in the affected releases, allows a client that holds any CA-signed agent certificate to execute arbitrary code on the Puppet Server as its service user by submitting a report containing a crafted rich-data type via PUT request. Where the certificate authority autosigns requests without strong verification, an unauthenticated network attacker can obtain such a certificate.\n\n## Affected\n\n- `puppet_enterprise >= 2023.8.0 < 2023.8.13`\n- `puppet_enterprise >= 2025.0.0 < 2025.12.1`\n- `puppet_enterprise >= 2026.0.0 < 2026.0.1`\n\n## Remediation\n\nUpgrade to a release that bundles puppet-agent 8.22.2 or 9.1.3 (Puppet Enterprise 2023.8.13, 2025.12.1, or 2026.0.1) and restart puppet server so the fixed code is loaded.","depth":"midnight","depthScore":52,"depthScoreParts":{"impact":51.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}