VulnSocial

CVE-2026-15538Disclosure

LOWCVSS 5.3 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A weakness has been identified in primefaces primereact up to 10.9.8. This issue affects the function ObjectUtils.mutateFieldData of the file components/lib/utils/ObjectUtils.js of the component API. This manipulation of the argument Field causes improperly controlled modification of object prototype attributes. The attack is possible to be carried out remotely. Upgrading to version 10.9.9 and 11.0.0 is capable of addressing this issue. Patch name: 61f182e11d9ef52032ff56f420da763a6938236f. It is recommended to upgrade the affected component.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-94CWE-1321

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • Peaked 1d ago at 2 mentions (2026-07-13); latest day: 1
  • 3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-07-13: 2Mentions · 2026-08-27: 1Patch / Workaround · 2026-08-27: 1Technical Details · 2026-07-13: 207-1308-27
Signal classification2 categories
Disclosure
266.7%
Patch
133.3%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-07-132
Disclosure2
2026-08-271
Patch1
Full discourse3 posts
  • Cagatay Civici@cagataycivici
    Patch

    PrimeReact v10.9.9 is out with a fix for CVE-2026-15538. https://github.com/primefaces/primereact/blob/master/CHANGELOG.md#1099-2026-08-27

    Post summary

    PrimeReact v10.9.9 has been released with a fix for CVE-2026-15538, providing a patch to address the vulnerability.

    00010393
    8.6K followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-15538 A weakness has been identified in primefaces primereact up to 10.9.8. This issue affects the function ObjectUtils.mutateFieldData of the component API. This manipulat… https://www.cve.org/CVERecord?id=CVE-2026-15538 ----- Traducción: CVE-2026-15538 Se … http://infoflow.cloud`

    Post summary

    The text announces CVE-2026-15538 as a weakness in primefaces primereact up to 10.9.8, affecting ObjectUtils.mutateFieldData; it includes a link to the CVE record but no PoC, exploit, or patch details.

    0000039
    92 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-15538 A weakness has been identified in primefaces primereact up to 10.9.8. This issue affects the function ObjectUtils.mutateFieldData of the component API. This manipulat… https://www.cve.org/CVERecord?id=CVE-2026-15538

    Post summary

    A new weakness in PrimeFaces PrimeReact up to version 10.9.8 affecting ObjectUtils.mutateFieldData has been reported, with no PoC, exploit, patch, or active exploitation details provided.

    00000658
    57.8K followersView on X

Explore more

Back to dashboard