Multiple vulnerabilities in Typo3 (August 18, 2026)

unknownCVE-2026-19418 CVE-2026-15305

Multiple vulnerabilities were discovered in Typo3. They allow an attacker to cause a bypass of the security policy.

CSIRTS triage

vendor: Typo3 product: Typo3Other

What: Multiple vulnerabilities allow an attacker to bypass security policies.
Who is affected: Typo3 instances affected by CVE-2026-19418 and CVE-2026-15305.
Urgency: Unknown severity; security policy bypass is serious but current exploitation and affected versions are unclear.
Action: Review Typo3 security advisories for affected versions; apply patches for CVE-2026-19418 and CVE-2026-15305 when available.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Typo3

Get an email when a new Typo3 advisory drops — max one per day, one-click unsubscribe.

Details

Source: CERT-FR Avis de sécurité (FR · national-cert · site)
Severity: unknown
Published: 2026-08-18
Exploitation: Not in CISA KEV at last sync
Language: Machine-translated to English — verify against the original

Original advisory: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1036/

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-194180.21% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 11% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-153050.25% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 17% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-19418	coverage & exploitation status	NVD · CVE.org
CVE-2026-15305	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

Recent advisories for Typo3

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

medium[NEU] [mittel] TYPO3 Core: Mehrere Schwachstellencert-bund · 2026-09-08
unknownMultiples vulnérabilités dans Typo3 (08 septembre 2026)cert-fr-avis · 2026-09-08
highGHSA-68jx-f42c-7599: TYPO3 CMS - Broken Access Control in Backend and Install Toolghsa · 2026-09-01
mediumGHSA-mfqj-cqv3-h7xw: TYPO3 CMS - Unrestricted File Upload in Form Frameworkghsa · 2026-08-31
critical[NEW] [critical] TYPO3 Extensions: Multiple Vulnerabilitiescert-bund · 2026-08-26
unknownCVE-2026-77131: When OpenSSL is unavailable on the server, the extension transmits TYPO3 system information in…nvd · 2026-08-25