Professional / Community 2026.4.3

Summary: PortSwigger released Burp Suite Professional and Community 2026.4.3 on Wednesday, 13 May 2026, fixing a high-impact vulnerability in browser-based crawling of malicious websites on Windows. The release also fixes an issue where Burp ran disabled custom scan checks in live tasks and audit-only scans, and credits bug bounty hunter Masahiro Kawada (@kawakatz) for reporting the crawling flaw.
Key Takeaway: The flaw sits in browser-based crawling of malicious sites on Windows, so a tester who points Burp at an untrusted target could be the one exposed - and the second fix means disabled scan checks were still running in live tasks and audit-only scans, quietly changing what your results actually reflect.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026