CVE-2012-5358: The XSLTCompiledTransform function in Ektron Content Management System (CMS) before 8.02 SP5 configures the...

Security readout for executives and security teams

Older Ektron CMS versions can process malicious XSL in a way that lets a remote attacker read server files. The CVE also links this to authentication bypass, viewstate modification, denial of service, and possible other impacts. No active exploitation evidence is provided in the bundle. Exposure is most likely in legacy Ektron CMS deployments older than 8.02 SP5, especially internet-facing systems or features that accept or transform XSL data. The bundle does not provide CPEs, endpoint names, or affected deployment patterns. Prioritize remediation for any internet-facing legacy Ektron CMS. The issue can expose server files and weaken authentication controls, but evidence for active exploitation is not supplied. Mitigation focus: Upgrade Ektron CMS to 8.02 SP5 or later per vendor release guidance.; Check vendor documentation for any additional configuration mitigations.; Limit public access to affected CMS functions where feasible..

Prepared

Jun 12, 2026, 20:07 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.