Read the docs
TI-2026-30819 Aliases CVE-2026-42539

IRIS has an Excessive Data Exposure issue

Priority MEDIUM 62CWE-201Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-201.

Summary

IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 return sensitive data to the user which are not required for the client’s operation. Version 2.4.28 contains a patch.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00232 14th percentileScored 2026-11-07
Fix Fixed iris-web (dfir-iris): 2.4.28

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
dfir-irisiris-webbefore 2.4.282.4.28Patch availableCNA
  • iris-web Vendordfir-iris Affected before 2.4.28 Fixed in 2.4.28 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:dfir-iris:iris:*:*:*:*:*:*:*:*——dfir-iris
  • cpe:2.3:a:dfir-iris:iris:*:*:*:*:*:*:*:* Versions — — ·dfir-iris

Remediation

  • Fix · CNA iris-web (dfir-iris) Fixed in 2.4.28

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-42539

References

Other 1

  • TI-2026-15096 DFIR-IRIS Stored XSS in Datastore Upload CVSS 3.1HIGH 7.6
  • TI-2026-14129 DFIR-IRIS Stored XSS in Assets CVSS 3.1HIGH 7.6
  • TI-2026-30818 IRIS has an Insecure File Upload CVSS 3.1MEDIUM 6.3
  • TI-2026-30827 IRIS Alerts Can be Falsely Attributed to Customers CVSS 3.1MEDIUM 5.4
  • TI-2026-30635 Iris has an Open Redirect issue CVSS 3.1MEDIUM 4.7
  • TI-2026-30823 IRIS has a Cross-Site Request Forgery (CSRF) issue CVSS 3.1MEDIUM 4.3
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences