Cyber Resilience

CVE-2026-89058

Published
18 September 2026
Modified
19 September 2026
CVSS Score v3.1 7.4
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
EPSS Score 0.0033 27th percentile
Risk Priority 53 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2026-89058 is a high-severity Permissive Cross-domain Security Policy with Untrusted Domains (CWE-942) vulnerability. Its CVSS base score is 7.4 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 27th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

A02:2025 Security Misconfiguration

EU & UK References

Vulnerability Data

A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to make credentialed…

more

cross-origin requests and read authenticated responses from a victim's session, resulting in a loss of confidentiality.

CWE(s)
CWE-942

Related Threats

MITRE ATT&CK Enterprise Techniques

T1189 Drive-by Compromise Initial Access
Adversaries may gain access to a system through a user visiting a website over the normal course of browsing.
attack.mitre.org →
T1557 Adversary-in-the-Middle Credential Access
Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as [Network Sniffing](https://attack.
attack.mitre.org →
T1659 Content Injection Initial Access
Adversaries may gain access and continuously communicate with victims by injecting malicious content into systems through online network traffic.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

Affected Assets

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V3.4.3
  • V3.4.6
  • V3.5.2

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

ID.RA-01 partial match
prevents

Vulnerability identification processes can surface permissive policy misconfigurations.

PR.PS-01 partial match
prevents

Hardened configuration baselines and reviews directly prevent permissive CSP or cross-domain policies.

PR.PS-06 partial match
prevents

Secure SDLC activities include review and testing of web security policies to avoid untrusted domains.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.20 Networks security partial match
degrades

Network security policies can restrict cross-domain communication but do not specifically mandate strict CSP or cross-domain policy configuration.

A.8.21 Security of network services partial match
degrades

Security of network services includes defining allowed endpoints, which can limit untrusted domains but does not directly address web-client policy files.

A.8.23 Web filtering partial match
degrades

Web filtering can block untrusted domains at the network level, partially mitigating permissive cross-domain policies.

A.8.26 Application security requirements partial match
prevents

Application security requirements should specify secure CSP and cross-domain policy settings, directly addressing the weakness.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure architecture principles include defining trust boundaries, which can reduce permissive cross-domain allowances.

A.8.28 Secure coding partial match
prevents

Secure coding practices require proper configuration of CSP and cross-domain policies to avoid untrusted domains.

References