CVE-2026-22888
Cybozu Garoon 5.0.0 – 6.0.3
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-22888 is a medium-severity Improper Handling of Extra Values (CWE-231) vulnerability in Cybozu Garoon. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 33th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-22888 is an improper input verification vulnerability affecting Cybozu Garoon versions 5.0.0 through 6.0.3. The issue, classified under CWE-231, allows unauthorized alteration of portal settings, which can potentially block user access to the product. It has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high severity primarily due to its impact on availability.
A remote, unauthenticated attacker can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation enables the attacker to modify portal settings, leading to denial of service by blocking access to Garoon for legitimate users.
Mitigation details are provided in advisories from JVN (https://jvn.jp/en/jp/JVN35265756/) and Cybozu Knowledge Base (https://kb.cybozu.support/article/39083/), published around the CVE disclosure on 2026-02-02. Security practitioners should consult these for patch information and workarounds applicable to affected Garoon installations.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-5121
Vulnerability Data
Improper input verification issue exists in Cybozu Garoon 5.0.0 to 6.0.3, which may lead to unauthorized alteration of portal settings, potentially blocking access to the product.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Input validation directly enforces correct handling of the number and format of supplied values, stopping extra values from being accepted or processed.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require robust input validation that prevents improper handling of extra values.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect extra-value handling issues but does not prevent them by itself.
Secure development lifecycle includes input validation and parameter handling that can prevent extra-value processing flaws.
Application security requirements typically mandate strict input validation and parameter count checks.
Secure architecture principles encourage robust input handling but do not specifically address extra-value scenarios.
Secure coding standards directly require validation of the exact number and type of input parameters.