CISA warns about a flaw in Jet Admin Cloud Platform
KROMSE explanation
Jet Admin Cloud Platform has a critical security flaw (CVE-2026-123965, CVSS 9.3). The official record says: A prompt injection vulnerability in all versions of Jet Admin Cloud Platform allows a remote attacker with a free account to expose sensitive .env configuration files and exfiltrate critical credentials. Mitigated via sandbox component around October 29, 2026.
No confirmed attacks and no public attack code yet.
Anyone running Jet Admin Cloud Platform.
- Install the maker's update for Jet Admin Cloud Platform as soon as it is out.
- Not sure if you use it? KROMSE can check your product for free.
