High severity · published Jul 14, 2026
CVE-2026-8590
Spotfire OAuth2 PKCE Bypass for public clients
8.7
CVSS
0.4%
EPSS
No
On KEV
Description
Vulnerability in Spotfire Spotfire Enterprise (Spotfire Server modules), Spotfire Spotfire Enterprise with External Consumers (Spotfire Server modules), Spotfire Spotfire on Kubernetes (Spotfire Server modules).
This issue affects Spotfire Enterprise: through 14.0.12, through 14.4.2, through 14.5.0, through 14.6.1, through 14.6.2, through 14.7.0, through 14.8.0; Spotfire Enterprise with External Consumers: through 14.0.12, through 14.5.0, through 14.6.0, through 14.6.1, through 14.6.2, through 14.7.0, through 14.8.0; Spotfire on Kubernetes: through 4.2.0, 5.0.X, 6.0.X.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SE
Spotfire Enterprise · Spotfire
through 14.0.12; through 14.4.2; through 14.5.0; through 14.6.1; through 14.6.2; through 14.7.0; +1 more · source: vendor
SE
Spotfire Enterprise with External Consumers · Spotfire
through 14.0.12; through 14.5.0; through 14.6.0; through 14.6.1; through 14.6.2; through 14.7.0; +1 more · source: vendor
SO
Spotfire on Kubernetes · Spotfire
through 4.2.0; 5.0.x; 6.0.x · source: vendor