High severity · published Feb 2, 2026
CVE-2026-22888
Improper input verification issue exists in Cybozu Garoon 5.0.0 to 6.0.3, which may lead to unauthorized alteration of portal settings, potentially blocking access to the product
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
Improper input verification issue exists in Cybozu Garoon 5.0.0 to 6.0.3, which may lead to unauthorized alteration of portal settings, potentially blocking access to the product.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 39% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CG
Cybozu Garoon · Cybozu, Inc.
5.0.0 to 6.0.3 · source: vendor
GA
Garoon · Cybozu
5.0.0 before 6.0.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-22888
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-22888
Third Party Advisory
https://jvn.jp/en/jp/JVN35265756/
Vendor Advisory
https://kb.cybozu.support/article/39083/
More from Cybozu Garoon
6.8
CVE-2026-57279
Cybozu Garoon contains a cross-site scripting vulnerability
6.1
CVE-2026-20711
Cross-site scripting vulnerability exists in E-mail function of Cybozu Garoon 5.0.0 to 6.0.3, which may allow an attacker to reset arbitrary users’ passwords
5.4
CVE-2026-22881
Cross-site scripting vulnerability exists in Message function of Cybozu Garoon 5.15.0 to 6.0.3, which may allow an attacker to reset arbitrary users’ passwords