CVE-2026-123965Jet Admin Cloud Platform

Prompt injection

Not on CISA's list of exploited flaws, and not in the news we track.

Chance of exploitation in 30 daysEPSS

0.34%

0%Higher than 28% of all CVEs

Exploited in the wild: Not confirmedBy CISA
Severity: 9.9 of 10Critical, CVSS
Used in ransomware: Not known
US federal deadline: None set

Fix it in one click

Fix it in your code

Claude Code Codex Cursor Claude Code (web)

Explain it to me

Claude ChatGPT

Each opens with a short prompt that points at Global Hack Map's public runbook for CVE-2026-123965. Nothing runs until you send it.

About this flaw

A prompt injection vulnerability in all versions of Jet Admin Cloud Platform allows a remote attacker with a free account to expose sensitive.env configuration files and exfiltrate critical credentials. Mitigated via sandbox component around October 29, 2026.

Published: 13 Nov 2026
Weakness: CWE-200

What should I do about this?

Advisories and references