Cvent | Trust Center

Cvent is aware of the eMudhra intermediate CA compromise and has completed an impact assessment. No Cvent certificates were issued by the affected intermediates. We have also identified no evidence of exploitation, interception, or unauthorized certificate use affecting Cvent. Removal of the compromised intermediates from Cvent-managed trust stores is in progress and we will update this notice when complete.

Finally, we have identified no impact to customer data, customer-facing services, or customer connections and we will continue to monitor and will update this notice if our status changes.

Please visit this announcement regularly as all updates will be published here as they become available.

To Our Customers,

Cvent's SOC 2 audit period will officially end on 10/31/2026. At that time, we will work with our independent third-party auditors to have a new SOC 2 report created for the following 12-month period, expiring on 10/31/2027.

Should you need a Bridge Letter in the interim, you can have one automatically generated for you using our website. Please navigate to the "View All Documents" area and you will see a folder for Bridge Letters where this can be done.

We anticipate our new report will be available by early December, 2026 and will ensure it is published to our Trust Center upon receipt from the auditing firm.

Please visit this announcement regularly as all updates will be published here as they become available.

Updated: 10/30/26 at 11:47am, EST

On October 21, 2026, the Node.js project disclosed CVE-2026-111497, a vulnerability in the Brotli decompression component of the Node.js runtime that could allow remote code execution in applications that process attacker-supplied compressed data. Fixed Node.js versions were released the same day.

Cvent has identified affected services in our environment and is upgrading them to patched versions. To date, we have found no evidence that this vulnerability has been exploited against Cvent systems or that customer data has been affected. Protective controls are in place at our network edge while upgrades are completed.

We will continue to monitor our environment and will update this notice as our status changes.

Updated: 10/30/26 at 11:48am, EST

On October 23, 2026, PHP maintainers gave early notice of CVE-2026-115560, a remote code execution vulnerability in PHP. It is separate from PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 (also known as the “PHP2Shell” vulnerabilities) announced earlier last week.

Since we learned of it, we have not identified any impact from this most recent PHP issue across relevant services and platforms. We will continue to investigate and monitor for any changes within our environment and will provide updates should our status change.

Also, while there is no patch currently available to fix this vulnerability, we will closely monitor for its release and apply it through our standard patch management process once it is available.

Please visit this announcement regularly as all updates will be published here as they become available.

Updated: 10/29/26 at 11:45am, EST
 
Over the past week, Cvent has continued to actively respond to PHP vulnerabilities and can now confirm that all impacted products listed below are fully remediated:

• Venue Directory
• Jifflenow
• Goldcast
• Prismm
• Splash
• Event Diagramming
• iCapture

Cvent will continue to have deployed layered protections providing defense-in-depth, from edge-based blocking of exploitation attempts to internal detection and response controls in place and actively monitor all previously affected services. There are no indications of any impact to customer data or product availability at this time.

Please visit this announcement regularly as all updates will be published here as they become available.