CVE-2026-90481
In PortSwigger Burp Suite DAST (formerly Burp Suite Enterprise Edition) before 2026.8, an authentication bypass can occur via an alternate path or channel.
PortSwigger Burp Suite DAST
CVSS
9.2CriticalExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.33%Chance of exploitation activity in the next 30 days, higher than 24% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 2026.8Burp Suite DASTCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Affected versions 1
- Burp Suite DASTaffected: 2021.11 before 2026.8CVE List