Dassault Systèmes Publishes Six Tuleap Enterprise Security Advisories
Tech GuruQuick Answer
Dassault Systèmes published six High-severity advisories for Tuleap Enterprise Edition 17.0 through 17.5. Identify exposed instances and privileged tracker workflows, obtain the exact supported fixed build from the vendor remediation channel, validate the upgrade, and retain evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory Tuleap Enterprise Edition 17.0 through 17.5, review internet and administrative exposure, map each instance to the six vendor advisories, obtain and deploy the vendor-supported fixed build, and validate tracker administration, rendering, database access, integrations, and audit logging.
Last verified: 2026-10-12 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Tuleap Enterprise Edition 17.0 through 17.5 |
|---|---|
| Advisory | CVE-2026-105407 / CVE-2026-105408 / CVE-2026-105409 / CVE-2026-105410 / CVE-2026-105411 / CVE-2026-105412 |
| CVEs | CVE-2026-105407, CVE-2026-105408, CVE-2026-105409, CVE-2026-105410, CVE-2026-105411, CVE-2026-105412 |
| Authoritative release date | 2026-10-12 05:26:18 UTC |
| Latest vendor page metadata time | 2026-10-12 08:14:06 UTC |
| Affected versions | Tuleap Enterprise Edition 17.0 through 17.5, with CVE-2026-105412 specifically affecting the 17.5 line, as stated by the vendor pages. |
| Fixed version | The public advisories direct customers to Dassault Systèmes remediation information but do not state public fixed-build numbers; obtain the supported fixed build through the vendor channel |
| CVSS base score | 7.1 / 8.1 / 8.7 / 8.8 (CVSS v4.0, vendor CNA records) |
| CVSS severity | High |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
Dassault Systèmes disclosed command injection, three stored cross-site scripting flaws, an authorization bypass through a user-controlled key, and SQL injection in Tuleap Enterprise Edition.
What To Validate Now
- Inventory. Locate Tuleap Enterprise Edition 17.0 through 17.5 deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Compare each deployment with the authority's affected-version statement: Tuleap Enterprise Edition 17.0 through 17.5, with CVE-2026-105412 specifically affecting the 17.5 line, as stated by the vendor pages. Do not infer applicability from product family or severity alone.
- Remediate. Apply The public advisories direct customers to Dassault Systèmes remediation information but do not state public fixed-build numbers; obtain the supported fixed build through the vendor channel through the supported vendor or project channel, following the current advisory and change-control requirements.
- Validate. Confirm the resulting version or managed-service state, exercise representative functionality and recovery paths, monitor for regressions, and document exceptions.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
The public pages do not state fixed-build numbers. Do not infer a safe build from the affected range; use Dassault Systèmes remediation information and preserve the vendor case or portal evidence supporting the selected release. Preserve the authority snapshot, asset and owner records, before-and-after versions, change approval, installation output, validation results, exceptions, and rollback evidence.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
