Is CVE-2026-15538 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-15538?

CVE-2026-15538 has a CVSS v3 severity of MEDIUM (6.3).

Back

CVE-2026-15538

Description

A weakness has been identified in primefaces primereact up to 10.9.8. This issue affects the function ObjectUtils.mutateFieldData of the component API. This manipulation of the argument Field causes improperly controlled modification of object prototype attributes. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not responded yet. This vulnerability only affects products that are no longer supported by the maintainer.