# Mattermost Server patches remote DoS flaw

Published: 2026-10-27 · Severity: routine · Sectors: Technology
Canonical: https://vorant.io/reports/35d7bffa-33d3-5add-b703-1d61734d5bcd/mattermost-server-patches-remote-dos-flaw
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> CERT-FR advises a remote denial-of-service vulnerability in Mattermost Server versions before 11.7.11, 11.8.6, 11.9.2, and 11.10.0.

Source: cert.cyber.gouv.fr — https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1388

## What to check

- Applies to: The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: No exploitation in the wild and no public exploit is recorded for the CVEs named.

CERT-FR issued an advisory regarding a vulnerability in Mattermost Server that allows a remote attacker to trigger a denial-of-service condition. The flaw, tracked as CVE-2026-116516, affects Mattermost Server versions 11.7.x prior to 11.7.11, 11.8.x prior to 11.8.6, 11.9.x prior to 11.9.2, and all versions prior to 11.10.0. Mattermost published the corresponding security bulletin MMSA-2026-00723 on 26 October 2026.

No evidence of active exploitation is mentioned in the advisory. Defenders running affected Mattermost Server versions should apply the vendor-provided patches referenced in the official security bulletin as soon as possible to mitigate the risk of service disruption.

## Mentioned in this report

- Vulnerabilities: CVE-2026-116516

Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1388

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/35d7bffa-33d3-5add-b703-1d61734d5bcd/mattermost-server-patches-remote-dos-flaw.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup