2026-07-23NOTABLEGLPI patches a critical form-import RCE and a full MFA bypass in the ITSM/asset platform widely run by EU public-sector, education and healthcare
GLPI 11.0.8/10.0.26 security release (critical RCE via form import; MFA bypass)
cve · CVE-2026-47679
Coverage
1
first 2026-07-23 → last 2026-07-23
Latest activity
2026-07-23
GLPI patches a critical form-import RCE and a full MFA bypass in the ITSM/asset platform widely run by EU…
Peak priority
notable
1 notable
Targets
public-sector
sectors: public-sector, healthcare, education · regions: europe
Sources cited
3
3 hosts
Action items (1)
Do-now tasks recorded on the entries about CVE-2026-47679, newest first. Check the date before acting on an older one.
- Update internet-facing GLPI instances to 11.0.8 (11.0.x) or 10.0.26 (10.0.x) now, the release fixes a critical form-import RCE and a complete MFA bypass that together defeat the authentication hardening the 11.x branch specifically introduced.2026-07-23CVE-2026-48482 +9
Defender insights
What each entry about CVE-2026-47679 tells a defender to do, newest first.
Triage
Story timeline
ATT&CK techniques (4 across 5 tactics)
4 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)
- Initial AccessExploit Public-Facing Application
- PersistenceModify Authentication Process: Multi-Factor Authentication
- Privilege EscalationExploitation for Privilege Escalation
- Defense ImpairmentModify Authentication Process: Multi-Factor Authentication
- Credential AccessBrute Force · Modify Authentication Process: Multi-Factor Authentication
Initial Access TA0001
T1190Exploit Public-Facing Application×1
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.
Evidence: 2026-07-23/glpi-11-0-8-10-0-26-critical-rce-mfa-bypass · ATT&CK page ↗
Persistence TA0003
T1556.006Modify Authentication Process: Multi-Factor Authentication×1
Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent access to compromised accounts.
Evidence: 2026-07-23/glpi-11-0-8-10-0-26-critical-rce-mfa-bypass · ATT&CK page ↗
Privilege Escalation TA0004
T1068Exploitation for Privilege Escalation×1
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Evidence: 2026-07-23/glpi-11-0-8-10-0-26-critical-rce-mfa-bypass · ATT&CK page ↗
Defense Impairment TA0112
T1556.006Modify Authentication Process: Multi-Factor Authentication×1
Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent access to compromised accounts.
Evidence: 2026-07-23/glpi-11-0-8-10-0-26-critical-rce-mfa-bypass · ATT&CK page ↗
Credential Access TA0006
T1110Brute Force×1
Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained. Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism. Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes.
Evidence: 2026-07-23/glpi-11-0-8-10-0-26-critical-rce-mfa-bypass · ATT&CK page ↗
T1556.006Modify Authentication Process: Multi-Factor Authentication×1
Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent access to compromised accounts.
Evidence: 2026-07-23/glpi-11-0-8-10-0-26-critical-rce-mfa-bypass · ATT&CK page ↗
Entries about GLPI 11.0.8/10.0.26 security release (critical RCE via form import; MFA bypass) (1)
Co-occurring entities
Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.
- GLPI×1
- GLPI 11.0.8/10.0.26 security release (critical RCE via form import; MFA bypass)×1
- GLPI 11.0.8/10.0.26 security release (critical RCE via form import; MFA bypass)×1
- GLPI 11.0.8/10.0.26 security release (critical RCE via form import; MFA bypass)×1
- GLPI 11.0.8/10.0.26 security release (critical RCE via form import; MFA bypass)×1
- GLPI 11.0.8/10.0.26 security release (critical RCE via form import; MFA bypass)×1
- GLPI 11.0.8/10.0.26 security release (critical RCE via form import; MFA bypass)×1
- GLPI 11.0.8/10.0.26 security release (critical RCE via form import; MFA bypass)×1
Where this entity is cited
Source distribution
- cert.ssi.gouv.fr1 (33%)
- glpi-project.org1 (33%)
- it-connect.tech1 (33%)
External references
All cited sources (3)
- glpi-project.orgprimaryGLPI Projecthttps://www.glpi-project.org/en/glpi-11-0-8-and-10-0-26-available/
- cert.ssi.gouv.frCERT-FR / ANSSIhttps://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0909/
- it-connect.techIT-Connecthttps://www.it-connect.tech/glpi-11-0-8-and-10-0-26-patch-16-flaws-including-2-critical-vulnerabilities/