CVE-2026-35482Disclosure(alf / alf)

LOWCVSS 9.1 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch alf alf systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5-2606, a sandbox escape vulnerability in the alf.io extension script engine allows an authenticated administrator to execute arbitrary operating system commands on the server. The extension system is intended to execute restricted JavaScript in a sandboxed Rhino environment; however, a combination of an unguarded injected Java object (`returnClass`) and an incomplete AST blocklist allows the sandbox to be fully escaped using Java reflection without triggering any validation errors. Version 2.0-M5-2606 patches the issue.

alf CVEs Back to dashboard

2.3/ 10 priority

Sources & remediation

Exploit / PoC references

Weakness type (CWE)

CWE-863

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

Threat summary

Public PoC is present in monitored signal
Patch or workaround signal is available
14 mentions across 11 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 3 signals
Patch or workaround mentioned in 2 signals
Technical details provided in 10 signals
Disclosure: 6 classified signals
Peaked 9d ago at 4 mentions (2026-06-04); latest day: 1
14 total mentions across 11 days

Affected systems

Vendors

alf

Products

alf

Deep dive

Activity timeline14 mentions / 11d

Signal classification5 categories

Disclosure

642.9%

PoC

321.4%

Patch

214.3%

General

214.3%

Disclouser

17.1%

Referenced assets10 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-03	1	Disclosure1
2026-06-04	4	Disclosure2Patch1PoC1
2026-06-24	1	General1
2026-06-29	1	PoC1
2026-07-03	1	PoC1
2026-07-06	1	Disclosure1
2026-07-08	1	General1
2026-07-23	1	Patch1
2026-08-05	1	Disclouser1
2026-08-22	1	Disclosure1
2026-09-27	1	Disclosure1

Full discourse14 posts

Segun@sudosheggs106d
PoC
NoScope: Finding RCE 🔥🔥🔥 This room shows how an AI-powered penetration testing platform (NoScope) autonomously discovers and validates a real-world Remote Code Execution (RCE) vulnerability. The room is based on CVE-2026-35482, a genuine vulnerability @ireteeh @segoslavia https://t.co/8TMQpVP8o2
Post summary
The tweet announces a demo of NoScope discovering a real‑world RCE (CVE‑2026‑35482), but offers no exploit code, patch, or evidence of active attacks.
1512211.7K
1.0K followersView on X
NoScope@trynoscope135d
PoC
@CVEnew This vulnerability was discovered by our AI pentesting agent. Technical details on how it was discovered here - https://www.noscope.com/blog/cve-2026-35482-noscope-alf-rce
Post summary
The tweet announces the discovery of CVE‑2026‑35482 and links to a blog post that presumably includes a proof of concept for the RCE, but it does not discuss active exploitation or remediation.
020842.9K
135 followersView on X
Hezron Munge Chacha@HezyChacha73d
Disclouser
I just completed NoScope: Finding RCE room on TryHackMe! NoScope found an http://Alf.io RCE zero-day (CVE-2026-35482). Exploit it manually and watch AI solve it. https://tryhackme.com/room/noscoperce?utm_campaign=social_share&utm_medium=social&utm_content=room&utm_source=twitter&sharerId=61a68593725cf6005e2fb968 #tryhackme via @tryhackme
Post summary
The author reports the discovery of an RCE zero‑day (CVE-2026-35482) on Alf.io and encourages manual exploitation via a TryHackMe challenge.
00050401
454 followersView on X
NoScope@trynoscope110d
PoC
New walkthrough is live on @tryhackme. Learn how to exploit CVE-2026-35482 manually, set up continuous pentesting with NoScope, and watch NoScope autonomously find and validate a real zero-day in action. CVE-2026-35482 is a sandbox escape in Alf that leads to full RCE. Link in comments. Try it out now.
Post summary
The post advertises a live walkthrough on TryHackMe that demonstrates exploiting CVE‑2026‑35482, detailing it as a sandbox escape leading to remote code execution. No patches or active wild exploitation claims are mentioned.
11120527
148 followersView on X
CVE@CVEnew136d
Disclosure
CVE-2026-35482 http://alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5-2606, a sandbox escape vulnerability … https://www.cve.org/CVERecord?id=CVE-2026-35482
Post summary
The text announces the existence of CVE-2026-35482, a sandbox escape vulnerability in Alf.io prior to version 2.0‑M5‑2606, without providing PoC, exploit code, or patch details.
10210854
57.6K followersView on X
Napa County Corruption 🕵@NapaCorruption103d
Disclosure
I just completed NoScope: Finding RCE room on TryHackMe! NoScope found an http://Alf.io RCE zero-day (CVE-2026-35482). Exploit it manually and watch AI solve it. https://tryhackme.com/room/noscoperce?utm_campaign=social_share&utm_medium=social&utm_content=room&utm_source=twitter&sharerId=63d417a8e9eef70044a768b6 #tryhackme via @tryhackme
Post summary
The post announces the discovery of a new RCE zero‑day CVE‑2026‑35482 in a TryHackMe challenge, without providing exploit code, patches, or evidence of active exploitation.
00030250
1.3K followersView on X
NoScope@trynoscope135d
Disclosure
NoScope found CVE-2026-35482 an RCE in Alf, a self-hosted ticketing platform used for conferences, trade shows, and festivals worldwide Full technical breakdown in comments 🧵 https://t.co/DmFVBWU8B6
Post summary
NoScope identified CVE-2026-35482, an RCE in the Alf ticketing platform, and posted a technical breakdown in tweet comments, but no PoC, exploit code, patch, or active exploitation evidence is mentioned.
10110123
106 followersView on X
NoScope@trynoscope135d
Disclosure
Our AI agent recently found an RCE in http://alf.io full details about the vulnerability - https://www.noscope.com/blog/cve-2026-35482-noscope-alf-rce
Post summary
An RCE vulnerability (CVE-2026-35482) was discovered in the alf.io website; detailed technical information is available on the linked Noscope blog post.
0002073
135 followersView on X
NoScope@trynoscope135d
Patch
Load any Java class. Invoke the runtime. Execute commands on the underlying server. Passed validation clean. Executed clean CVE-2026-35482. Patched and disclosed. https://t.co/8vEDuImlPT
Post summary
CVE‑2026‑35482 has been disclosed and patched, but no proof‑of‑concept, exploit code, or active exploitation details are provided.
1000054
106 followersView on X
UNDERCODE TESTING@UndercodeUpdate19d
Disclosure
🚨 #AI-Driven Remote Code Execution: Exploiting #CVE-2026-35482 in Alfio via Sandbox Evasion and Reflection + Video -Prediction: 📈 1 Positive | 📉 0 Negative https://undercodetesting.com/ai-driven-remote-code-execution-exploiting-cve-2026-35482-in-alfio-via-sandbox-evasion-and-reflection-video/ Educational Purposes!
Post summary
The tweet announces CVE-2026-35482 targeting Alfio via Remote Code Execution with sandbox evasion and reflection techniques, but provides no patch, exploit tool, or evidence of active in-the-wild exploitation.
0000045
750 followersView on X
Tamilvanan@tmlvnn56d
Disclosure
I just completed NoScope: Finding RCE room on TryHackMe! NoScope found an http://Alf.io RCE zero-day (CVE-2026-35482). Exploit it manually and watch AI solve it. https://tryhackme.com/room/noscoperce?utm_campaign=social_share&utm_medium=social&utm_content=room&utm_source=twitter&sharerId=5f203e59cf08ce29f634dacc #tryhackme via @tryhackme
Post summary
NoScope announced a new RCE zero‑day (CVE‑2026‑35482) on http://Alf.io via a TryHackMe room, but no exploit code, patch, or active exploitation details are provided.
00000124
23 followersView on X
DFIR Lab@DFIR_Lab86d
Patch
🚨 HIGH: CVE-2026-35482 (CVSS 8.0) - Sandbox escape in alf[.]io ticket system allows authenticated admins to execute arbitrary OS commands via Java reflection. Version 2.0-M5-2606 patches this issue. #CVE #PatchNow https://t.co/XcgL1DiM2c
Post summary
The tweet alerts about a high‑severity sandbox escape in alf.io that lets authenticated admins run arbitrary OS commands; a patch (v2.0‑M5‑2606) is already available.
0000038
91 followersView on X
ケイ | IT・セキュリティ系副業Webライター@Teeeda_worker101d
General
CVE-2026-35482 http://alf.ioの脆弱性をわかりやすく解説｜影響範囲と対策まとめ https://www.cybernote.click/2026/07/02/cve-2026-35482-alfio/ #IT #Security #cybersecurity
Post summary
The post references CVE‑2026‑35482 and links to an explanatory article but provides no concrete details, PoC, exploit code, or patch information in the provided text.
0000035
208 followersView on X
ケイ | IT・セキュリティ系副業Webライター@Teeeda_worker115d
General
CVE-2026-35482 http://alf.ioの脆弱性をわかりやすく解説｜影響範囲と対策まとめ https://www.cybernote.click/2026/06/17/cve-2026-35482-alfio/ #IT #Security #cybersecurity
Post summary
The post merely links to an article about CVE-2026-35482, providing no PoC, exploit details, active usage, patch information, or technical specifics.
0000027
208 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	alf	alf	-	-	-

Explore more

Back to dashboard alf CVEs alf vulnerabilities

What researchers are saying

CVE-2026-35482

NoScope[verified]@trynoscopePoC

The tweet announces the discovery of CVE‑2026‑35482 and links to a blog post that presumably includes a proof of concept for the RCE, but it does not discuss active exploitation or remediation.

NoScope[verified]@trynoscopePoC

The post advertises a live walkthrough on TryHackMe that demonstrates exploiting CVE‑2026‑35482, detailing it as a sandbox escape leading to remote code execution. No patches or active wild exploitation claims are mentioned.

NoScope[verified]@trynoscopeDisclosure

NoScope identified CVE-2026-35482, an RCE in the Alf ticketing platform, and posted a technical breakdown in tweet comments, but no PoC, exploit code, patch, or active exploitation evidence is mentioned.

NoScope[verified]@trynoscopeDisclosure

An RCE vulnerability (CVE-2026-35482) was discovered in the alf.io website; detailed technical information is available on the linked Noscope blog post.

NoScope[verified]@trynoscopePatch

CVE‑2026‑35482 has been disclosed and patched, but no proof‑of‑concept, exploit code, or active exploitation details are provided.

DFIR Lab[verified]@DFIR_LabPatch

The tweet alerts about a high‑severity sandbox escape in alf.io that lets authenticated admins run arbitrary OS commands; a patch (v2.0‑M5‑2606) is already available.

Segun@sudosheggsPoC

The tweet announces a demo of NoScope discovering a real‑world RCE (CVE‑2026‑35482), but offers no exploit code, patch, or evidence of active attacks.

Hezron Munge Chacha@HezyChachaDisclouser

The author reports the discovery of an RCE zero‑day (CVE-2026-35482) on Alf.io and encourages manual exploitation via a TryHackMe challenge.