Perforce · Exploitation confirmed

Puppet: public exploits for two critical flaws; fixes available

Nov 05, 2026 · 1 min read

Neodyme published exploit details for two critical Puppet flaws: server-side code execution via crafted reports (CVE-2026-115731, CVSS 4.0 9.4 per Perforce) and node impersonation via flawed certificate-name checks (CVE-2026-115732, CVSS 4.0 9.0). Perforce and OpenVox confirmed fixes; the source states there is no evidence of malicious exploitation and neither CVE is in CISA KEV. Update Puppet Enterprise to 2023.8.13, 2025.12.1 or 2026.0.1 and restart puppetserver.

By HIFY Radar newsroom Updated 11/05/2026 05:01 AM Get this every day →← Back to the feed 1 source

HighVulnerabilityExploitation confirmedPatched

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

Security firm Neodyme published exploit details for two critical flaws in Puppet, a fleet server management tool. One enables code execution on the central server (CVSS 9.4); the other enables impersonating a managed node (CVSS 9.0). Perforce and OpenVox have confirmed fixes are available.

Why it matters

The central Puppet server manages the machine fleet. Per the source, compromising it can expose the certificate authority keys and, depending on orchestration settings, open a path to managed hosts. Weak autosign policies can hand attackers the certificates needed for exploitation.

What to do

Update Puppet Enterprise to 2023.8.13, 2025.12.1 or 2026.0.1, depending on your version, and restart puppetserver. OpenVox administrators should follow its separate component advisories. Review autosign policies.

For the technical team

CVE: CVE-2026-115731, CVE-2026-115732
Affected: Perforce (Puppet); OpenVox Puppet e OpenVox (certificados de agente e servidor de gestão da frota) · Puppet Enterprise 2023.8.0–2023.8.12, 2025.0.0–before 2025.12.1, and 2026.0.0. OpenVox: follow its separate component advisories.
Exploitation: Neodyme published exploit details (public demonstration). The source stresses that public demonstrations are not evidence of malicious exploitation; neither CVE appears in the CISA KEV snapshot checked.
Fix: Update to 2023.8.13, 2025.12.1 or 2026.0.1 as applicable, then restart puppetserver to load the RCE fix. OpenVox: fixes via separate per-component advisories.
Vector: Puppet server. CVE-2026-115731: crafted reports enable server-side code execution. CVE-2026-115732: flawed certificate-name checks enable node impersonation. Exploitation depends on certificates; weak autosign policies can let attackers obtain them.
More details: Perforce rates CVE-2026-115731 as CVSS 4.0 9.4 and CVE-2026-115732 as CVSS 4.0 9.0. Compromising the central server can expose CA keys and, depending on orchestration settings, open a path to managed hosts. A Puppet agent certificate can become a route to the fleet's management server.