---
id: CVE-2026-115731
title: Report Deserialization Code Execution
summary: >-
  Deserialization of untrusted data in the report-processing code of Puppet, as
  used by Puppet Server, in the affected releases, allows a client that holds
  any CA-signed agent certificate to execute arbitrary code on the Puppet Server
  as i…
severity: critical
cvss: 9.4
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'
cvssSource: cna
cwe:
  - CWE-502
  - CWE-94
vendor: Perforce
product: Puppet Enterprise
affected:
  - puppet_enterprise >= 2023.8.0 < 2023.8.13
  - puppet_enterprise >= 2025.0.0 < 2025.12.1
  - puppet_enterprise >= 2026.0.0 < 2026.0.1
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-06T19:36:26.464307Z'
published: '2026-11-03'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T19:36:39.577Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115731'
references:
  - url: >-
      https://portal.perforce.com/s/cve/a91Qi000003IaHpIAK/report-deserialization-code-execution
tags:
  - cve.org
epss: 0.00366
epssPercentile: 0.30593
ingestedAt: '2026-11-05T20:33:06.478Z'
---

## Overview

Deserialization of untrusted data in the report-processing code of Puppet, as used by Puppet Server, in the affected releases, allows a client that holds any CA-signed agent certificate to execute arbitrary code on the Puppet Server as its service user by submitting a report containing a crafted rich-data type via PUT request. Where the certificate authority autosigns requests without strong verification, an unauthenticated network attacker can obtain such a certificate.

## Affected

- `puppet_enterprise >= 2023.8.0 < 2023.8.13`
- `puppet_enterprise >= 2025.0.0 < 2025.12.1`
- `puppet_enterprise >= 2026.0.0 < 2026.0.1`

## Remediation

Upgrade to a release that bundles puppet-agent 8.22.2 or 9.1.3 (Puppet Enterprise 2023.8.13, 2025.12.1, or 2026.0.1) and restart puppet server so the fixed code is loaded.