Cyber Resilience

CVE-2025-26496

Critical

Published: 22 August 2025

Published
22 August 2025
Modified
04 November 2025
KEV Added
—
Patch
—
CVSS Score v3.1 9.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0005 17.3th percentile
Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-26496 is a critical-severity Type Confusion (CWE-843) vulnerability in Tableau Tableau Server. Its CVSS base score is 9.3 (Critical).

Operationally, ranked at the 17.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in Salesforce Tableau Server, Tableau Desktop on Windows, Linux (File Upload modules) allows Local Code Inclusion.This issue affects Tableau Server, Tableau Desktop: before 2025.1.3, before 2024.2.12, before 2023.3.19.

CWE(s)
CWE-843

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

tableau
tableau server
≤ 2023.3.19 · 2024.2 — 2024.2.12 · 2025.1 — 2025.1.3

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References