Medium severity · published Aug 25, 2026
CVE-2026-77131
Cleartext Transmission of Sensitive Information in extension "SYSSY - TYPO3 Monitoring & Security Checks" (syssy)
5.3
CVSS
0.2%
EPSS
No
On KEV
Description
When OpenSSL is unavailable on the server, the extension transmits TYPO3 system information in cleartext instead of encrypting it. Exploitation requires the attacker to already be in control of the SYSSY project's API key.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ES
Extension "SYSSY - TYPO3 Monitoring & Security Checks" · TYPO3
before 3.0.6 · source: vendor
Affected product
ES
Extension "SYSSY - TYPO3 Monitoring & Security Checks"
TYPO3
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-77131
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-77131
typo3.org
https://typo3.org/security/advisory/typo3-ext-sa-2026-015
More from Extension "SYSSY - TYPO3 Monitoring & Security Checks"
5.3
CVE-2026-77130
Insufficient Session Expiration in extension "SYSSY - TYPO3 Monitoring & Security Checks" (syssy)