Ghostwire

CVE-2026-115994: BOLA Allows Cross-Project Target Tampering in Cervantes version v1.3-beta could allow an attacker modify or delete...

MEDIUM CVSS 5.4 Exploit Available

Published: October 24, 2026 | Last Modified: October 24, 2026

Description

BOLA Allows Cross-Project Target Tampering in Cervantes version v1.3-beta could allow an attacker modify or delete targets belonging to other projects without authorization, compromising the integrity of penetration testing scopes, results, and associated security reports.

Ghostwire Analysis — What This Means Practically

Medium CVSS score indicates moderate risk — exploitation requires specific conditions or results in limited impact.
Exploit code is reported to be available, increasing the likelihood of active exploitation.

This analysis is generated by Ghostwire from NVD, CISA KEV, EPSS, and open-source intelligence data. Verify findings through primary sources before acting.

References

www.grayback.es/advisories
www.grayback.es/en/advisories
www.tenable.com/cve/CVE-2026-115994
www.cnnvd.org.cn/home/globalSearch?keyword=CVE-2026-115994