Is CVE-2026-27197 actively exploited?

No active exploitation of CVE-2026-27197 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-27197 be exploited remotely?

Yes. CVE-2026-27197 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-27197?

CVE-2026-27197 has a CVSS score of 9.1 (CRITICAL) and an EPSS exploitation probability of 0.04%.

HOME VULNERABILITIESCVE-2026-27197

CRITICAL

CVE-2026-27197

CWE-287Published: February 21, 2026· Updated: Feb 23, 2026

9.1

CVSS v3.1

EPSS:0.04%probability of exploitation in 30 daysPercentile:13.3th

Official Description

Sentry is a developer-first error tracking and performance monitoring tool. Versions 21.12.0 through 26.1.0 have a critical vulnerability in its SAML SSO implementation which allows an attacker to take over any user account by using a malicious SAML Identity Provider and another organization on the same Sentry instance. Self-hosted users are only at risk if the following criteria is met: ore than one organizations are configured (SENTRY_SINGLE_ORGANIZATION = True), or malicious user has existing access and permissions to modify SSO settings for another organization in a multo-organization instance. This issue has been fixed in version 26.2.0. To workaround this issue, implement user account-based two-factor authentication to prevent an attacker from being able to complete authentication with a victim's user account. Organization administrators cannot do this on a user's behalf, this requires individual users to ensure 2FA has been enabled for their account.

NVD Source

Technical Analysis

CVE-2026-27197 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), with a CVSS base score of 9.1.

From a weakness classification perspective (CWE-287): Authentication bypass vulnerabilities allow attackers to access protected resources without valid credentials.