{"id":7324,"date":"2026-04-16T17:17:04","date_gmt":"2026-04-16T14:17:04","guid":{"rendered":"https:\/\/support.withsecure.com\/?post_type=announcement&#038;p=7324"},"modified":"2026-10-19T13:11:34","modified_gmt":"2026-10-19T10:11:34","slug":"cve-2026-40175-for-axios-javascript-library-2","status":"publish","type":"announcement","link":"https:\/\/support.withsecure.com\/fi\/announcements\/cve-2026-40175-for-axios-javascript-library-2\/","title":{"rendered":"CVE-2026-40175 for Axios JavaScript library"},"content":{"rendered":"<h2 data-id=\"what-is-axios\"><strong>What is Axios?<\/strong><\/h2>\n<p>Axios is a JavaScript library intended to ease interaction with internet HTTP services. It is used by some organizations to simplify their codebase compared to using standard browser functionality.<\/p>\n<h2 data-id=\"what-is-the-vulnerability\"><strong>What is the vulnerability?<\/strong><\/h2>\n<p>Prior to version 1.15.0, the Axios library is vulnerable to a specific &#8221;Gadget&#8221; attack chain that allows Prototype Pollution in any third-party dependency to be escalated into Remote Code Execution (RCE) or Full Cloud Compromise (via AWS IMDSv2 bypass).<\/p>\n<p>Ref: <a href=\"https:\/\/community.withsecure.com\/home\/leaving?allowTrusted=1&amp;target=https%3A%2F%2Fnvd.nist.gov%2Fvuln%2Fdetail%2FCVE-2026-40175\" rel=\"nofollow noopener ugc\" target=\"_blank\">https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-40175<\/a><\/p>\n<h2 data-id=\"has-the-vulnerability-been-fixed\"><strong>Has the vulnerability been fixed?<\/strong><\/h2>\n<p>This vulnerability has been fixed in 1.15.0.<\/p>\n<h2 data-id=\"what-are-withsecure-s-recommendations-for-partners-and-customers\"><strong>What are WithSecure\u2019s recommendations for partners and customers?<\/strong><\/h2>\n<p>We recommend partners and customers who use Axios act immediately to ensure their systems are not vulnerable.<\/p>\n<p><strong>WithSecure Exposure Management<\/strong> can detect and notify partners and customers that they have a vulnerable version.<\/p>\n<p>Detection for vulnerable versions is available in unauthenticated scanning, and we are investigating the possibility to detect them on hosts via authenticated scans<\/p>\n<h2 data-id=\"what-is-the-status-of-withsecure-systems-in-relation-to-this-vulnerability\"><strong>What is the status of WithSecure systems in relation to this vulnerability?<\/strong><\/h2>\n<p>WithSecure has thoroughly checked its own systems, and has confirmed that all services using Axios are using the latest version which is not vulnerable.<\/p>\n<h2 data-id=\"are-any-withsecure-products-affected\"><strong>Are any WithSecure products affected?<\/strong><\/h2>\n<p>WithSecure Policy Manager does contain a vulnerable version of the Axios library, and we have created a hotfix for this issue.  We advise all our Business Suite partners and customers to apply this hotfix at the earliest opportunity.<\/p>\n<p>The risk can further be mitigated by ensuring that Policy Manager\u2019s Web Reporting interface is not accessible from the internet. This can be done with external firewall configurations.<\/p>\n<p>The hotfix can be downloaded from the <a href=\"https:\/\/community.withsecure.com\/home\/leaving?allowTrusted=1&amp;target=https%3A%2F%2Fsupport.withsecure.com%2Fen%2Fsupport%2Fproduct-support%2Fbusiness-suite%2Fpolicy-manager%23download\" target=\"_blank\" rel=\"nofollow noopener ugc\">WithSecure Download Center<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>What is Axios? Axios is a JavaScript library intended to ease interaction with internet HTTP services. It is used by some organizations to simplify their codebase compared to using standard&hellip;<\/p>\n","protected":false},"template":"","announcement_category":[144],"class_list":["post-7324","announcement","type-announcement","status-publish","hentry"],"acf":{"source_system":"vanilla-import","import_hash":"0bbeec67dc0b0895229a27008297e214e0d2bf39","vanilla_article_id":32898,"legacy_author":"AndyF_WS","vanilla_url":"https:\/\/community.withsecure.com\/announcements-en\/kb\/articles\/32898-cve-2026-40175-for-axios-javascript-library","vanilla_category_id":227,"machine_translated":false},"_links":{"self":[{"href":"https:\/\/support.withsecure.com\/fi\/wp-json\/wp\/v2\/announcement\/7324","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/support.withsecure.com\/fi\/wp-json\/wp\/v2\/announcement"}],"about":[{"href":"https:\/\/support.withsecure.com\/fi\/wp-json\/wp\/v2\/types\/announcement"}],"version-history":[{"count":1,"href":"https:\/\/support.withsecure.com\/fi\/wp-json\/wp\/v2\/announcement\/7324\/revisions"}],"predecessor-version":[{"id":8859,"href":"https:\/\/support.withsecure.com\/fi\/wp-json\/wp\/v2\/announcement\/7324\/revisions\/8859"}],"wp:attachment":[{"href":"https:\/\/support.withsecure.com\/fi\/wp-json\/wp\/v2\/media?parent=7324"}],"wp:term":[{"taxonomy":"announcement_category","embeddable":true,"href":"https:\/\/support.withsecure.com\/fi\/wp-json\/wp\/v2\/announcement_category?post=7324"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}