CVE-2022-36431: Rocketsoftware Trufusion

Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days.

An arbitrary file upload vulnerability in Rocket TRUfusion Enterprise before 7.9.6.1 allows unauthenticated attackers to execute arbitrary code via a crafted JSP file. Issue fixed in version 7.9.6.1.

Affected products

• Rocketsoftware Trufusion: before 7.9.6.1 (fixed in 7.9.6.1)

Published 2022-12-01. Last modified 2026-06-17.