by Kastro
Paper/Archive/CVE-2026-80462

CVE-2026-80462

Progress Software Chef Automate — Privilege Escalation in Progress Chef Automate

EPSS 2%CVSS 10.0
critical.is priorityof 100
46
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 80.8.808 × 2016.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A vulnerability in the Chef Automate API gateway and identity validation path may allow an unauthenticated actor to gain elevated access to protected Chef Automate functionality under specific conditions.

Affected

ProductAffectedFixed inSource
Chef Automate4.13.516 – < 4.13.5204.13.520CNA

Scores by source

ProgressSoftware (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorycommunity.progress.com/s/article/Critical-Security-Bulletin---August-2026---Chef-Automate-Security-Vulnerability