Field brief
Jet Admin Cloud Platform Prompt Injection Vulnerability CVE-2026-123965
CISA rates CVE-2026-123965 at 9.9 and reports a sandbox mitigation, but the advisory also says no fix is available; verify protection and rotate exposed secrets.
On November 13, CISA published VA-26-317-01 for CVE-2026-123965, a prompt-injection vulnerability affecting all versions of Jet Admin Cloud Platform. CISA says a remote attacker with a free account could expose `.env` configuration files and exfiltrate credentials, and assigns CVSS 9.9. The advisory’s SSVC record marks exploitation as none and the CVE is not listed in CISA’s Known Exploited Vulnerabilities catalog. CISA says the issue was mitigated through a sandbox component around October 29, but the same advisory records “no fix available,” so organizations should not assume that a conventional patch or fixed release exists. Jet Admin customers should confirm with the vendor that the sandbox mitigation is active for their tenant, restrict unnecessary account access, rotate credentials that may have been exposed, review relevant access logs, and monitor the advisory for a formal remediation update.
See what applies to your environment.
Use the Ncerio CVE feed to move from general intelligence to affected products.