VulnSocial

CVE-2026-84186Disclosure

LOWCVSS 6.9 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Vulnerability involving incorrect access control in the Tools::getRemoteAddr() function in PrestaShop, which allows the client’s IP address to be spoofed via the X-Forwarded-For header when the application is running behind a reverse proxy, load balancer or CDN. The application incorrectly processes the IP address string and uses the address controlled by the visitor rather than the one provided by the trusted infrastructure, allowing an unauthenticated remote attacker to cause the application to interpret their connection as originating from an arbitrary IP address. This condition allows IP-based controls, such as the maintenance mode allowlist, to be bypassed, as well as enabling the forgery of security and audit logs and the evasion of third-party mechanisms that rely on the IP address, such as geolocation checks, fraud detection or request throttling.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-290

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • Peaked 1d ago at 2 mentions (2026-09-07); latest day: 1
  • 3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-09-07: 2Mentions · 2026-09-14: 1Patch / Workaround · 2026-09-14: 1Technical Details · 2026-09-07: 209-0709-14
Signal classification2 categories
Disclosure
266.7%
Patch
133.3%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-09-072
Disclosure2
2026-09-141
Patch1
Full discourse3 posts
  • HostingTG@HostingTG
    Patch

    Si tienes una tienda en PrestaShop, revisa esto cuanto antes. La vulnerabilidad CVE-2026-84186 ya tiene corrección, pero necesitas actualizar y revisar si usas CDN o proxy. Lo explicamos aquí: https://www.hostingtg.com/blog/si-tienes-prestashop-necesitas-actualizar/ #PrestaShop #SeguridadWeb

    Post summary

    The post primarily warns PrestaShop store operators that CVE-2026-84186 has a fix and that they should update and review CDN/proxy configurations. It does not provide exploit code, active exploitation evidence, or detailed technical vulnerability information.

    0000045
    969 followersView on X
  • NewNormal Security@NewScanTeam
    Disclosure

    NewNormal Security turns the last 24 hours of CVEs into new detections, every day. 𝗗𝗮𝗶𝗹𝘆 𝗖𝗩𝗘 𝗥𝗲𝗽𝗼𝗿𝘁 — 7 Sep 2026 𝗔𝗹𝗿𝗲𝗮𝗱𝘆 𝗰𝗼𝘃𝗲𝗿𝗲𝗱 by NewScan: 🔓 IP allow-list bypass via a spoofed X-Forwarded-For — reaches the admin pages the IP check was the only thing guarding (PrestaShop CVE-2026-84186) 𝗔𝗱𝗱𝗲𝗱 to NewScan 𝘁𝗼𝗱𝗮𝘆: 📦 Deserialization RCE in an http://ASP.NET file-upload control — unauthenticated code execution on the web server (Progress Telerik CVE-2026-13181, CVE-2026-13182, CVE-2026-13183, CVE-2026-13184, CVE-2026-13185, CVE-2026-13186, CVE-2026-13190) 📦 Stored XSS in a WordPress plugin's lazy-load image parser — script that runs for every later visitor to the page (Powerkit CVE-2026-2390) Test your stack with NewScan — free, self-hosted: https://newnormalsecurity.com/newscan?utm_source=x&utm_medium=social&utm_campaign=daily-cve #infosec #AppSec #Deserialization #CSO #REDTEAM

    Post summary

    NewScan reports several new CVEs—deserialization RCEs in Progress Telerik and a stored XSS in Powerkit—providing details but no exploit, patch, or active exploitation information.

    0000060
    7 followersView on X
  • INCIBE-CERT@incibe_cert
    Disclosure

    ⚠️#INCIBEaviso | Control de acceso incorrecto en #PrestaShop #CVE-2026-84186 https://www.incibe.es/incibe-cert/alerta-temprana/avisos/control-de-acceso-incorrecto-en-prestashop #AvisosDeSeguridad #TI #CNA #0day

    Post summary

    INCIBE has issued a security advisory about an incorrect access control issue in PrestaShop (CVE‑2026‑84186), but it provides no PoC, exploit, or patch details.

    0000077
    52 followersView on X

Explore more

Back to dashboard