Read the docs
TI-2026-30827 Aliases CVE-2026-42547

IRIS Alerts Can be Falsely Attributed to Customers

Priority MEDIUM 58CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

IRIS is a web collaborative platform that helps incident responders share technical details during investigations. In versions prior to 2.4.28, users can create alerts for customers that are not assigned to them. This can be abused to falsely attribute fake alerts to customers. In combination with Cross-Site Scripting, this can also be used to exfiltrate alerts from other customers. Version 2.4.28 contains a patch.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00174 6th percentileScored 2026-11-07
Fix Fixed iris-web (dfir-iris): 2.4.28

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
dfir-irisiris-webbefore 2.4.282.4.28Patch availableCNA
  • iris-web Vendordfir-iris Affected before 2.4.28 Fixed in 2.4.28 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:dfir-iris:iris:*:*:*:*:*:*:*:*——dfir-iris
  • cpe:2.3:a:dfir-iris:iris:*:*:*:*:*:*:*:* Versions — — ·dfir-iris

Remediation

  • Fix · CNA iris-web (dfir-iris) Fixed in 2.4.28

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-42547

References

Other 1

  • TI-2026-15096 DFIR-IRIS Stored XSS in Datastore Upload CVSS 3.1HIGH 7.6
  • TI-2026-14129 DFIR-IRIS Stored XSS in Assets CVSS 3.1HIGH 7.6
  • TI-2026-30819 IRIS has an Excessive Data Exposure issue CVSS 3.1MEDIUM 6.5
  • TI-2026-30818 IRIS has an Insecure File Upload CVSS 3.1MEDIUM 6.3
  • TI-2026-30635 Iris has an Open Redirect issue CVSS 3.1MEDIUM 4.7
  • TI-2026-30823 IRIS has a Cross-Site Request Forgery (CSRF) issue CVSS 3.1MEDIUM 4.3
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences