Apache Software Foundation Apache Skywalking vulnerabilities

2 CVEs affecting Apache Software Foundation Apache Skywalking, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-85229, published 2026-09-04.

More from Apache Software Foundation.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-85229, published 2026-09-04. Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days. ** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache SkyWalking Booster UI. This issue affects Apache…
• CVE-2026-71216, published 2026-09-04. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. PagerDuty alarm hook transmits the integration routing key over cleartext HTTP. PagerDuty serves this endpoint over HTTPS and will normally answer plain HTTP with a redirect. That does not remove…