CISA ADP Vulnrichment

Answer in brief

CVE-2026-97155 records a Medium severity (CVSS 6.5) vulnerability in CISA ADP Vulnrichment. The current sources do not mark it as known exploited. The current feed maps Fabasoft/Folio Client (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Sep 24, 2026Updated Sep 26, 2026Source checked Sep 27, 2026First seen by HOL Sep 24, 2026Material review Sep 26, 2026

Upstream Advisory

Key facts

Risk: Medium · CVSS 6.5
Exploitation: Not marked as known exploited
Affected software: 1 mapped package or product
Fix availability: Available

Why this deserves its current priority

CVSS is 6.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps Fabasoft/Folio Client (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
Fabasoft/Folio Clientgeneric	>=0 <2026	2026

Recommended response

Check inventory. Check lockfiles and deployed manifests for Fabasoft/Folio Client.
Review the reported fix. Source-reported solution: The vendor changed the product: setup now requires a value for "VALIDDOMAINS", and the client blocks all domains if the value is absent. Note that this change applies to new installations only; existing installations remain in the insecure default state until an administrator sets the value manually.

Evidence timeline and material changes

Published upstream
Sep 24, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Sep 26, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Sep 24, 2026

Sources and claim methodology

Source referencehelp.supportservices.fabasoft.com

Upstream source description

Fabasoft Folio Client before 2026, a locally installed component that communicates with the Fabasoft browser extension via web messaging, does not restrict which web origins may invoke its functions by default. The registry value VALIDDOMAINS, which limits permitted origins, was optional and empty by default, resulting in all domains being trusted. As a consequence, any website visited by a user with the Folio Client and browser extension installed could invoke client functions, e.g., related to downloading documents, opening documents, and synchronizing files. The first fixed builds are Fabasoft Folio Client 2026 (Build 26.0.0.10) and Fabasoft Folio Client 2026 April Release (Build 26.4.0.76). This client is, for example, shipped with Fabasoft eGov-Suite.

Quoted source text, attributed separately from HOL analysis.