Vulnerability-Lookup

CVE-2026-78573 (GCVE-0-2026-78573)

Vulnerability from cvelistv5 – Published: 2026-09-10 21:42 – Updated: 2026-09-11 20:31

Title

IBM ContextForge MCP Gateway is affected by use of default credentials

Summary

IBM ContextForge MCP Gateway 1.0.0 through 1.0.7 could allow a remote attacker to gain administrative access due to the use of default credentials.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-11 19:17 UTC

CWE

CWE-1392 - Use of Default Credentials

Assigner

ibm mitre root

References

1 reference

URL	Tags
https://www.ibm.com/support/pages/node/7286834	vendor-advisorypatch

Impacted products

1 product

Vendor	Product	Version	CPE status
IBM	ContextForge MCP Gateway	Affected: 1.0.0 , ≤ 1.0.7 (semver) cpe:2.3:a:ibm:contextforge_mcp_gateway:1.0.0:::::::* cpe:2.3:a:ibm:contextforge_mcp_gateway:1.0.7:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-78573",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-11T19:17:11.160433Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-11T20:31:29.613Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:contextforge_mcp_gateway:1.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:contextforge_mcp_gateway:1.0.7:*:*:*:*:*:*:*"
          ],
          "product": "ContextForge MCP Gateway",
          "vendor": "IBM",
          "versions": [
            {
              "lessThanOrEqual": "1.0.7",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIBM ContextForge MCP Gateway 1.0.0 through 1.0.7 could allow a remote attacker to gain administrative access due to the use of default credentials.\u003c/p\u003e"
            }
          ],
          "value": "IBM ContextForge MCP Gateway 1.0.0 through 1.0.7 could allow a remote attacker to gain administrative access due to the use of default credentials."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1392",
              "description": "CWE-1392 Use of Default Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-10T21:42:36.717Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://www.ibm.com/support/pages/node/7286834"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003cstrong\u003eIBM strongly recommends addressing the vulnerability now.\u003c/strong\u003e\u003c/p\u003e\u003cdiv\u003e\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u003cstrong\u003eProduct(s)\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eVersion(s) number and/or range\u00a0\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eRemediation/Fix/Instructions\u003c/strong\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM ContextForge MCP Gateway\u003c/td\u003e\u003ctd\u003ev1.0.0 - v1.0.9\u003c/td\u003e\u003ctd\u003eUpgrade to v1.0.10. See \u003ca href=\"https://github.com/IBM/mcp-context-forge/releases/tag/v1.0.10\" rel=\"nofollow\"\u003erelease notes\u003c/a\u003e. Additionally, ensure\u00a0\u003ccode\u003eplatform_admin_password\u003c/code\u003e,\u00a0\u003ccode\u003edefault_user_password\u003c/code\u003e, and\u00a0\u003ccode\u003ebasic_auth_password\u003c/code\u003e\u00a0are set to strong, non-default values before enabling\u00a0\u003ccode\u003eapi_allow_basic_auth\u003c/code\u003e\u00a0or\u00a0\u003ccode\u003emcpgateway_ui_enabled\u003c/code\u003e.\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003cp\u003e\u00a0Note: \u0026lt;Component A / B names\u0026gt; are bundled with \u0026lt;Product profile name\u0026gt; to provide \u0026lt;feature / function description\u0026gt;\u003c/p\u003e\u003cp\u003e\u003c/p\u003e"
            }
          ],
          "value": "IBM strongly recommends addressing the vulnerability now.\nProduct(s)Version(s) number and/or range Remediation/Fix/InstructionsIBM ContextForge MCP Gatewayv1.0.0 - v1.0.9Upgrade to v1.0.10. See release notes. Additionally, ensure platform_admin_password, default_user_password, and basic_auth_password are set to strong, non-default values before enabling api_allow_basic_auth or mcpgateway_ui_enabled. Note: \u003cComponent A / B names\u003e are bundled with \u003cProduct profile name\u003e to provide \u003cfeature / function description\u003e"
        }
      ],
      "title": "IBM ContextForge MCP Gateway is affected by use of default credentials",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eOn a default deployment,\u00a0\u003ccode\u003eapi_allow_basic_auth\u003c/code\u003e\u00a0and\u00a0\u003ccode\u003emcpgateway_ui_enabled\u003c/code\u003e\u00a0are both set to\u00a0\u003ccode\u003eFalse\u003c/code\u003e, which prevents the default credentials from being exposed through an active authentication path. Operators who have not enabled either of these features are not immediately at risk. If upgrading is not immediately possible, ensure both features remain disabled until the password fields are set to strong, operator-defined values.\u003c/p\u003e"
            }
          ],
          "value": "On a default deployment, api_allow_basic_auth and mcpgateway_ui_enabled are both set to False, which prevents the default credentials from being exposed through an active authentication path. Operators who have not enabled either of these features are not immediately at risk. If upgrading is not immediately possible, ensure both features remain disabled until the password fields are set to strong, operator-defined values."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2026-78573",
    "datePublished": "2026-09-10T21:42:36.717Z",
    "dateReserved": "2026-08-24T20:35:05.656Z",
    "dateUpdated": "2026-09-11T20:31:29.613Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-78573",
      "date": "2026-09-12",
      "epss": "0.00394",
      "percentile": "0.33025"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-78573\",\"sourceIdentifier\":\"psirt@us.ibm.com\",\"published\":\"2026-09-10T22:16:59.987\",\"lastModified\":\"2026-09-11T21:17:16.610\",\"vulnStatus\":\"Undergoing Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"IBM ContextForge MCP Gateway 1.0.0 through 1.0.7 could allow a remote attacker to gain administrative access due to the use of default credentials.\"}],\"affected\":[{\"source\":\"psirt@us.ibm.com\",\"affectedData\":[{\"vendor\":\"IBM\",\"product\":\"ContextForge MCP Gateway\",\"cpes\":[\"cpe:2.3:a:ibm:contextforge_mcp_gateway:1.0.0:*:*:*:*:*:*:*\",\"cpe:2.3:a:ibm:contextforge_mcp_gateway:1.0.7:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"1.0.0\",\"lessThanOrEqual\":\"1.0.7\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@us.ibm.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-09-11T19:17:11.160433Z\",\"id\":\"CVE-2026-78573\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"psirt@us.ibm.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-1392\"}]}],\"references\":[{\"url\":\"https://www.ibm.com/support/pages/node/7286834\",\"source\":\"psirt@us.ibm.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-78573\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-11T19:17:11.160433Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-11T19:17:19.278Z\"}}], \"cna\": {\"title\": \"IBM ContextForge MCP Gateway is affected by use of default credentials\", \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 9.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:ibm:contextforge_mcp_gateway:1.0.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:ibm:contextforge_mcp_gateway:1.0.7:*:*:*:*:*:*:*\"], \"vendor\": \"IBM\", \"product\": \"ContextForge MCP Gateway\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.0.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"1.0.7\"}]}], \"solutions\": [{\"lang\": \"en\", \"value\": \"IBM strongly recommends addressing the vulnerability now.\\nProduct(s)Version(s) number and/or range Remediation/Fix/InstructionsIBM ContextForge MCP Gatewayv1.0.0 - v1.0.9Upgrade to v1.0.10. See release notes. Additionally, ensure platform_admin_password, default_user_password, and basic_auth_password are set to strong, non-default values before enabling api_allow_basic_auth or mcpgateway_ui_enabled. Note: \u003cComponent A / B names\u003e are bundled with \u003cProduct profile name\u003e to provide \u003cfeature / function description\u003e\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003e\u003cstrong\u003eIBM strongly recommends addressing the vulnerability now.\u003c/strong\u003e\u003c/p\u003e\u003cdiv\u003e\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u003cstrong\u003eProduct(s)\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eVersion(s) number and/or range\\u00a0\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eRemediation/Fix/Instructions\u003c/strong\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM ContextForge MCP Gateway\u003c/td\u003e\u003ctd\u003ev1.0.0 - v1.0.9\u003c/td\u003e\u003ctd\u003eUpgrade to v1.0.10. See \u003ca href=\\\"https://github.com/IBM/mcp-context-forge/releases/tag/v1.0.10\\\" rel=\\\"nofollow\\\"\u003erelease notes\u003c/a\u003e. Additionally, ensure\\u00a0\u003ccode\u003eplatform_admin_password\u003c/code\u003e,\\u00a0\u003ccode\u003edefault_user_password\u003c/code\u003e, and\\u00a0\u003ccode\u003ebasic_auth_password\u003c/code\u003e\\u00a0are set to strong, non-default values before enabling\\u00a0\u003ccode\u003eapi_allow_basic_auth\u003c/code\u003e\\u00a0or\\u00a0\u003ccode\u003emcpgateway_ui_enabled\u003c/code\u003e.\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003cp\u003e\\u00a0Note: \u0026lt;Component A / B names\u0026gt; are bundled with \u0026lt;Product profile name\u0026gt; to provide \u0026lt;feature / function description\u0026gt;\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\", \"base64\": false}]}], \"references\": [{\"url\": \"https://www.ibm.com/support/pages/node/7286834\", \"tags\": [\"vendor-advisory\", \"patch\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"On a default deployment, api_allow_basic_auth and mcpgateway_ui_enabled are both set to False, which prevents the default credentials from being exposed through an active authentication path. Operators who have not enabled either of these features are not immediately at risk. If upgrading is not immediately possible, ensure both features remain disabled until the password fields are set to strong, operator-defined values.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eOn a default deployment,\\u00a0\u003ccode\u003eapi_allow_basic_auth\u003c/code\u003e\\u00a0and\\u00a0\u003ccode\u003emcpgateway_ui_enabled\u003c/code\u003e\\u00a0are both set to\\u00a0\u003ccode\u003eFalse\u003c/code\u003e, which prevents the default credentials from being exposed through an active authentication path. Operators who have not enabled either of these features are not immediately at risk. If upgrading is not immediately possible, ensure both features remain disabled until the password fields are set to strong, operator-defined values.\u003c/p\u003e\", \"base64\": false}]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"IBM ContextForge MCP Gateway 1.0.0 through 1.0.7 could allow a remote attacker to gain administrative access due to the use of default credentials.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eIBM ContextForge MCP Gateway 1.0.0 through 1.0.7 could allow a remote attacker to gain administrative access due to the use of default credentials.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-1392\", \"description\": \"CWE-1392 Use of Default Credentials\"}]}], \"providerMetadata\": {\"orgId\": \"9a959283-ebb5-44b6-b705-dcc2bbced522\", \"shortName\": \"ibm\", \"dateUpdated\": \"2026-09-10T21:42:36.717Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-78573\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-11T20:31:29.613Z\", \"dateReserved\": \"2026-08-24T20:35:05.656Z\", \"assignerOrgId\": \"9a959283-ebb5-44b6-b705-dcc2bbced522\", \"datePublished\": \"2026-09-10T21:42:36.717Z\", \"assignerShortName\": \"ibm\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-78573

Vulnerability from fkie_nvd - Published: 2026-09-10 22:16 - Updated: 2026-09-11 21:17

Severity

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

IBM ContextForge MCP Gateway 1.0.0 through 1.0.7 could allow a remote attacker to gain administrative access due to the use of default credentials.

References

	URL	Tags
	psirt@us.ibm.com	https://www.ibm.com/support/pages/node/7286834

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:contextforge_mcp_gateway:1.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:contextforge_mcp_gateway:1.0.7:*:*:*:*:*:*:*"
          ],
          "product": "ContextForge MCP Gateway",
          "vendor": "IBM",
          "versions": [
            {
              "lessThanOrEqual": "1.0.7",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "psirt@us.ibm.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "IBM ContextForge MCP Gateway 1.0.0 through 1.0.7 could allow a remote attacker to gain administrative access due to the use of default credentials."
    }
  ],
  "id": "CVE-2026-78573",
  "lastModified": "2026-09-11T21:17:16.610",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "psirt@us.ibm.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-78573",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-11T19:17:11.160433Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-10T22:16:59.987",
  "references": [
    {
      "source": "psirt@us.ibm.com",
      "url": "https://www.ibm.com/support/pages/node/7286834"
    }
  ],
  "sourceIdentifier": "psirt@us.ibm.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-1392"
        }
      ],
      "source": "psirt@us.ibm.com",
      "type": "Secondary"
    }
  ]
}

GHSA-87Q9-X2GP-QCHR

Vulnerability from github – Published: 2026-09-11 00:31 – Updated: 2026-09-11 00:31

Details

IBM ContextForge MCP Gateway 1.0.0 through 1.0.7 could allow a remote attacker to gain administrative access due to the use of default credentials.

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-78573"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1392"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-10T22:16:59Z",
    "severity": "CRITICAL"
  },
  "details": "IBM ContextForge MCP Gateway 1.0.0 through 1.0.7 could allow a remote attacker to gain administrative access due to the use of default credentials.",
  "id": "GHSA-87q9-x2gp-qchr",
  "modified": "2026-09-11T00:31:14Z",
  "published": "2026-09-11T00:31:14Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78573"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7286834"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-78573 (GCVE-0-2026-78573)

FKIE_CVE-2026-78573

GHSA-87Q9-X2GP-QCHR

Tags

Sightings

Nomenclature