Paper/Archive/CVE-2026-90481

CVE-2026-90481

PortSwigger Burp Suite DAST — In PortSwigger Burp Suite DAST (formerly Burp Suite Enterprise Edition) before 2026.8, an authentication bypass can occur via an alternat…

EPSS 0.3%CVSS 9.2

critical.is priorityof 100

CVSS 9.2 (CNA)9.2 / 10 × 3027.6 Not in CISA KEV+300.0 EPSS percentile 26.1.261 × 205.2 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

In PortSwigger Burp Suite DAST (formerly Burp Suite Enterprise Edition) before 2026.8, an authentication bypass can occur via an alternate path or channel.

Affected

ProductAffectedFixed inSource

Burp Suite DAST2021.11 – < 2026.82026.8CNA

Scores by source

mitre (CNA)9.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refportswigger.net/burp/releases/dast-2026-8