High severity · published Feb 2, 2026
CVE-2026-22888
Improper input verification issue exists in Cybozu Garoon 5.0.0 to 6.0.3, which may lead to unauthorized alteration of portal settings, potentially blocking access to the product
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
Improper input verification issue exists in Cybozu Garoon 5.0.0 to 6.0.3, which may lead to unauthorized alteration of portal settings, potentially blocking access to the product.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 39% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CG
Cybozu Garoon · Cybozu, Inc.
5.0.0 to 6.0.3 · source: vendor
GA
Garoon · Cybozu
5.0.0 before 6.0.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-22888
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-22888
Third Party Advisory
https://jvn.jp/en/jp/JVN35265756/
Vendor Advisory
https://kb.cybozu.support/article/39083/
More from Cybozu Garoon
9.0
CVE-2024-31401
Cross-site scripting vulnerability in Cybozu Garoon 5.0.0 to 5.15.2 allows a remote authenticated attacker with an administrative privilege to inject an arbitrary script on the…
6.8
CVE-2026-57279
Cybozu Garoon contains a cross-site scripting vulnerability
6.5
CVE-2024-31399
Excessive platform resource consumption within a loop issue exists in Cybozu Garoon 5.0.0 to 5.15.2
6.5
CVE-2024-31400
Insertion of sensitive information into sent data issue exists in Cybozu Garoon 5.0.0 to 5.15.0
6.5
CVE-2023-26595
Denial-of-service (DoS) vulnerability in Message of Cybozu Garoon 4.10.0 to 5.9.2 allows a remote authenticated attacker to cause a denial of service condition