Improper Authorization in SpecterOps BloodHound Affects Remote Operations
CVE-2026-85241

5.3MEDIUM

Key Information:

Vendor

Specterops

Status
Bloodhound
Vendor
CVE Published:
3 September 2026

What is CVE-2026-85241?

A vulnerability has been identified in SpecterOps BloodHound versions up to 9.5.1, specifically within the NewV2API function in the Graph Write Endpoint component. This weakness allows remote attackers to manipulate the system, potentially leading to unauthorized access. To safeguard against this risk, users are advised to upgrade to versions 9.6.0-rc1, 9.6.0, or 9.7.0-rc3, which incorporate a crucial patch to rectify the issue. Ensuring your application is updated is essential for maintaining security.

Affected Version(s)

BloodHound 9.0.0

BloodHound 9.1.0

BloodHound 9.2.2

References

https://vuldb.com/vuln/398471
vdb-entrytechnical-description
https://vuldb.com/vuln/398471/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-85241
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

b1d0ws (VulDB User)
VulDB Vulnerability Moderation Team
.