VulnRadar

Data against noise.

Page generated: 08 Nov 2026, 13:11 UTC

CVE-2023-32315

Read full description

Openfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based application, was found to be vulnerable to a path traversal attack via the setup environment. This permitted an unauthenticated user to use the unauthenticated Openfire Setup Environment in an already configured Openfire environment to access restricted pages in the Openfire Admin Console reserved for administrative users. This vulnerability affects all versions of Openfire that have been released since April 2015, starting with version 3.10.0. The problem has been patched in Openfire release 4.7.5 and 4.6.8, and further improvements will be included in the yet-to-be released first version on the 4.8 branch (which is expected to be version 4.8.0). Users are advised to upgrade. If an Openfire upgrade isn’t available for a specific release, or isn’t quickly actionable, users may see the linked github advisory (GHSA-gw42-f939-fhvm) for mitigation advice.

CVSS 8.6 (HIGH) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE

0.0/10

REALITY · THREAT PRIORITY

8.8/10

General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?

Recorded exploitation baseline: +7.00
Technical severity: CVSS 8.6: +1.29
Fresh EPSS: 100.00%: +0.50

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 11 documents and public datasets.

Hype components

Headline sample (25%)

0/100

Press, 30 days (60%)

0/100

Grounded branding (15%)

0/100

HYPE TOTAL0/100

Sources and documents

Hong Kong Computer Emergency Response Team Coordination Centre

Press · 16 Jul 2026, 07:00 · StrikeShark Campaign Exploits Known Vulnerabilities to Deploy Cobalt Strike via SharkLoader - Hong Kong Computer Emergency Response Team Coordination Centre

Recorded Future

Press · 10 Jul 2026, 07:00 · June 2026 CVE Landscape - Recorded Future

SC Media

Press · 29 Jun 2026, 07:00 · New SharkLoader malware campaign deploys Cobalt Strike Beacon - SC Media

The Hacker News

Press · 26 Jun 2026, 07:00 · New SharkLoader Malware Deploys Cobalt Strike in StrikeShark Cyberattacks - The Hacker News

Help Net Security

Press · 13 Feb 2025, 08:00 · Sandworm APT’s initial access subgroup hits organizations accross the globe - Help Net Security

See all 11 source documents

BleepingComputer

Press · 26 Sep 2023, 07:00 · Hackers actively exploiting Openfire flaw to encrypt servers - BleepingComputer

The Hacker News

Press · 24 Aug 2023, 07:00 · Thousands of Unpatched Openfire XMPP Servers Still Exposed to High-Severity Flaw - The Hacker News

Security Affairs

Press · 24 Aug 2023, 07:00 · More than 3,000 Openfire servers exposed to attacks using a new exploit - Security Affairs

SecurityWeek

Press · 23 Aug 2023, 07:00 · 3,000 Openfire Servers Exposed to Attacks Targeting Recent Vulnerability - SecurityWeek

BleepingComputer

Press · 23 Aug 2023, 07:00 · Over 3,000 Openfire servers vulnerable to takover attacks - BleepingComputer

CCB Belgium

Press · 25 May 2023, 07:00 · WARNING: High risk vulnerability in Openfire xmpp server - CCB Belgium

Score evolution

● Hype ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 0.0 · reality 8.8 (2026-11-02 15:13). The curve appears once the score changes.

Public exploit evidence

Public exploit entries / repo candidates

See 2 repos with metrics

Repository	Stars	Forks	Language	Updated
izzz0/CVE-2023-32315-POC	5	1	Python	11 Jul 2023, 02:16
rag-fish/openfire-exploit-suite	0	0	Ruby	06 Sep 2025, 12:57

Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence: Exploitation recorded
Priority basis: Recorded exploitation; CVSS 8.6; EPSS 100.0%
Attention, last 30 days: 0 distinct story titles; 0 press documents; 0 publisher domains.
Technical potential: network access, no prior privileges, no user interaction.
Observed activity: Exploitation recorded in CISA KEV.
Known scale: Not quantified.
Evidence confidence basis: Trusted exploitation confirmation

Score evaluated: 2026-11-05 13:58:53.989029+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline

First press mention

25 May 2023, 07:00

Published

26 May 2023, 22:33

Added to the CISA KEV catalog

24 Aug 2023, 00:00

Latest press mention

16 Jul 2026, 07:00

Score calculated

05 Nov 2026, 13:58

PoCs on GitHub

2 repositories