CVE-2026-1290

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1290", "assignerOrgId": "67325c3f-c596-46c5-a235-e1a1e73abe4e", "state": "PUBLISHED", "assignerShortName": "JAMF", "dateReserved": "2026-01-21T15:24:32.098Z", "datePublished": "2026-01-21T15:25:19.543Z", "dateUpdated": "2026-01-21T15:49:21.064Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Jamf Pro", "vendor": "Jamf", "versions": [{"lessThanOrEqual": "11.24", "status": "affected", "version": "11.20", "versionType": "custom"}]}], "datePublic": "2026-01-20T15:10:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Authentication Bypass by Primary Weakness vulnerability in Jamf Jamf Pro allows unspecified impact.<p>This issue affects Jamf Pro: from 11.20 through 11.24.</p>"}], "value": "Authentication Bypass by Primary Weakness vulnerability in Jamf Jamf Pro allows unspecified impact.This issue affects Jamf Pro: from 11.20 through 11.24."}], "impacts": [{"descriptions": [{"lang": "en", "value": "unspecified impact"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 5.3, "baseSeverity": "MEDIUM", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-305", "description": "CWE-305: Authentication Bypass by Primary Weakness", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "67325c3f-c596-46c5-a235-e1a1e73abe4e", "shortName": "JAMF", "dateUpdated": "2026-01-21T15:25:19.543Z"}, "references": [{"url": "https://learn.jamf.com/en-US/bundle/jamf-pro-release-notes-11.24.0/page/Resolved_Issues.html"}], "source": {"discovery": "UNKNOWN"}, "title": "[PI141230] Fixed A broken access control issue.", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-21T15:48:43.243242Z", "id": "CVE-2026-1290", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-21T15:49:21.064Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1290", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-21T15:48:43.243242Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-21T15:49:06.529Z"}}], "cna": {"title": "[PI141230] Fixed A broken access control issue.", "source": {"discovery": "UNKNOWN"}, "impacts": [{"descriptions": [{"lang": "en", "value": "unspecified impact"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Jamf", "product": "Jamf Pro", "versions": [{"status": "affected", "version": "11.20", "versionType": "custom", "lessThanOrEqual": "11.24"}], "defaultStatus": "unaffected"}], "datePublic": "2026-01-20T15:10:00.000Z", "references": [{"url": "https://learn.jamf.com/en-US/bundle/jamf-pro-release-notes-11.24.0/page/Resolved_Issues.html"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Authentication Bypass by Primary Weakness vulnerability in Jamf Jamf Pro allows unspecified impact.This issue affects Jamf Pro: from 11.20 through 11.24.", "supportingMedia": [{"type": "text/html", "value": "Authentication Bypass by Primary Weakness vulnerability in Jamf Jamf Pro allows unspecified impact.<p>This issue affects Jamf Pro: from 11.20 through 11.24.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-305", "description": "CWE-305: Authentication Bypass by Primary Weakness"}]}], "providerMetadata": {"orgId": "67325c3f-c596-46c5-a235-e1a1e73abe4e", "shortName": "JAMF", "dateUpdated": "2026-01-21T15:25:19.543Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1290", "state": "PUBLISHED", "dateUpdated": "2026-01-21T15:49:21.064Z", "dateReserved": "2026-01-21T15:24:32.098Z", "assignerOrgId": "67325c3f-c596-46c5-a235-e1a1e73abe4e", "datePublished": "2026-01-21T15:25:19.543Z", "assignerShortName": "JAMF"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Jamf Pro", "vendor": "Jamf", "versions": [{"lessThanOrEqual": "11.24", "status": "affected", "version": "11.20", "versionType": "custom"}]}], "source": "67325c3f-c596-46c5-a235-e1a1e73abe4e"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Authentication Bypass by Primary Weakness vulnerability in Jamf Jamf Pro allows unspecified impact.This issue affects Jamf Pro: from 11.20 through 11.24."}, {"lang": "es", "value": "Vulnerabilidad de omisi\u00f3n de autenticaci\u00f3n por debilidad primaria en Jamf Jamf Pro permite impacto no especificado. Este problema afecta a Jamf Pro: desde 11.20 hasta 11.24."}], "id": "CVE-2026-1290", "lastModified": "2026-06-17T10:15:27.650", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "67325c3f-c596-46c5-a235-e1a1e73abe4e", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1290", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-21T15:48:43.243242Z", "version": "2.0.3"}}]}, "published": "2026-01-21T16:16:08.040", "references": [{"source": "67325c3f-c596-46c5-a235-e1a1e73abe4e", "url": "https://learn.jamf.com/en-US/bundle/jamf-pro-release-notes-11.24.0/page/Resolved_Issues.html"}], "sourceIdentifier": "67325c3f-c596-46c5-a235-e1a1e73abe4e", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-305"}], "source": "67325c3f-c596-46c5-a235-e1a1e73abe4e", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T15:33:15.956342+00:00", "value": {"mitigation_remediation": ["Upgrade Jamf Pro to a version newer than 11.24 to eliminate the authentication bypass.", "Consult Jamf\u2019s release notes for any additional security patches bundled with newer releases and apply them promptly.", "Validate that role\u2011based access controls are correctly enforced, particularly for privileged actions, to address the identified CWE\u2011305 weakness.", "Implement multi\u2011factor authentication and enforce strong password policies to reduce the risk of future authentication weaknesses."], "summary": {"action": "Patch", "impact": "Authentication Bypass (Broken Access Control)"}, "threat_synthesis": {"affected_systems": "Jamf Pro versions from 11.20 through 11.24 are affected. An impact on any environment using these versions must be evaluated to determine the scope of exposed resources and whether the authentication bypass could affect critical management tasks.", "description_and_impact": "The vulnerability is an authentication bypass caused by a primary weakness in Jamf Pro, allowing attackers to access the system without valid credentials. This broken access control can enable unauthorized users to view or modify data, run privileged commands, or otherwise compromise the affected Jamf environment. The description indicates unspecified impact, which could encompass a range of confidentiality, integrity, or availability concerns depending on the attacker\u2019s intent and system configuration.", "risk_and_exploitability": "The CVSS score of 5.3 denotes moderate severity, while the EPSS score of less than 1% indicates a low probability of exploitation at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed public exploits yet. The likely attack vector is remote, potentially through the web\u2011based administrative interface or API, though the exact method is not detailed in the source material. The authentication bypass nature means an attacker could obtain unauthorized access without initial credentials, and once inside, could conduct further malicious activities depending on the role permissions granted after bypass."}}}}, "created": "2026-01-22T10:15:06.044498+00:00", "updated": "2026-04-18T15:45:04.268156+00:00", "vendors": ["jamf", "jamf$PRODUCT$jamf"]}