Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N L N L L L 5.3 .0054 43.2 —
AFFECTED Product Versions Fixed primereact 10.9.0 – 10.9.9
TIMELINE Jul 12 Reserved by VulDB Jul 13 Published (CNA: VulDB) Aug 27 PATCH SHIPPED — CVE-2026-15538 (primefaces primereact). Fixed in primereact 10.9.9.
A weakness has been identified in primefaces primereact up to 10.9.8. This issue affects the function ObjectUtils.mutateFieldData of the file components/lib/utils/ObjectUtils.js of the component API. This manipulation of the argument Field causes improperly controlled modification of object prototype attributes. The attack is possible to be carried out remotely. Upgrading to version 10.9.9 and 11.0.0 is capable of addressing this issue. Patch name: 61f182e11d9ef52032ff56f420da763a6938236f. It is recommended to upgrade the affected component.
| Date | Event | Detail |
|---|---|---|
| July 12, 2026 | Reserved | Reserved by VulDB |
| July 13, 2026 | Published | Published (CNA: VulDB) |
| August 27, 2026 | PATCH SHIPPED | PATCH SHIPPED — CVE-2026-15538 (primefaces primereact). Fixed in primereact 10.9.9. |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| primefaces | primereact | — | 10.9.0 | 10.9.9 |
Authoritative record: CVE-2026-15538 at cve.org
Vendors: primefaces
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-15538 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
