CVE-2026-31798: JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v4.10.16-lts, JumpServer improperly validates…

PriorityP428medium5CVSS 3.1

AVNACHPRNUIRSUCLILAL

EPSS

0.10%

0.9th percentile

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v4.10.16-lts, JumpServer improperly validates certificates in the Custom SMS API Client. When JumpServer sends MFA/OTP codes via Custom SMS API, an attacker can intercept the request and capture the verification code BEFORE it reaches the user's phone. This vulnerability is fixed in v4.10.16-lts.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
fit2cloud	jumpserver	< 4.10.16	4.10.16
jumpserver	jumpserver	< 4.10.16-lts	4.10.16-lts

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.