Project MONAI CVE-2026-109360

Exploitation requires (1) the attacker to hold an on-path / man-in-the-middle position able to intercept and modify plaintext HTTP traffic between the victim and the pretrained-weights host, and (2) the victim to construct a SENet-family model - specifically SEResNet50 or other SENet models - with pretrained=True, which triggers load_state_dict_from_url to fetch and unpickle the .pth file without weights_only=True. Limiting factors: it does not fire against default use that never downloads pretrained weights, requires victim-initiated model construction (user interaction), and depends on weights being served over HTTP rather than a verified/HTTPS or locally-cached source; environments that pin, hash-verify, or pre-stage weights offline are not exposed.

This is a genuine but conditional risk that sits below its 7.7 HIGH rating in real-world urgency. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:P) confirms network reach and no required privileges, but two gating factors materially reduce likelihood: AT:P reflects a required on-path (man-in-the-middle) position to tamper with plaintext HTTP traffic, and UI:P requires a victim to actually construct a SENet model (e.g. SEResNet50) with pretrained=True so that weights are fetched and unpickled. Impact is severe and well-supported - full VC:H/VI:H/VA:H arbitrary code execution via CWE-502 insecure deserialization (load_state_dict_from_url without weights_only=True). No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical takeaway: prioritize patching to 1.6.1 for environments where MONAI pulls pretrained weights over untrusted networks, but this is not a mass-exploitation, internet-spray scenario - it requires attacker network positioning plus victim action, making it closer to a targeted/opportunistic threat than a wormable priority.

An attacker positioned on the network path (shared Wi-Fi, compromised proxy, or rogue gateway) between a MONAI user and the pretrained-weights host intercepts the plaintext HTTP request for the SENet .pth file. They substitute a malicious pickle payload, which executes arbitrary code the moment the data scientist instantiates SEResNet50 (or another SENet model) with pretrained=True. No public exploit code was provided in the input, but the deserialization sink is well-understood and trivially weaponizable once an on-path position exists.