CVE-2026-8412: Concretecms Concrete Cms

What is CVE-2026-8412?

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/cache. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting.

CVSS8.8 NVD 3.1

SeverityHIGH

ExploitationNo exploitation reported

EPSS<1% · P3

Triage statusNo Known Exploit

ActionPatch this week

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

NVD published2026-05-21

NVD last modified2026-07-23

Timeline

2026-05-21Published to the U.S. National Vulnerability Database (NVD)
2026-07-23NVD record last updated

Affected product

Concretecms Concrete Cms

Remediation Steps

Update Linux kernel to latest stable version via your distribution package manager.
Prioritize servers with local user access or multi-tenant environments.
No emergency action required.

References

Referenced in our briefings & reports

Vulnerability Priority Report – Week 3 of March 2026 (March 14–20)

Browse all tracked CVEs in the defend.network CVE database →

🤖 This CVE page is generated by defend.network from NVD, CISA KEV, EPSS, and our verified daily briefings. Severity and exploitation data come from official sources; always verify remediation steps against the official vendor advisory before acting in production.