What is the CVSS score of CVE-2026-1358?

CVE-2026-1358 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Airleader Master are affected by CVE-2026-1358?

Airleader Master versions 6.381 and earlier contain a critical vulnerability allowing unauthenticated attackers to upload files and execute arbitrary code on affected servers.

How to fix or mitigate CVE-2026-1358?

Within 24 hours: Inventory all Airleader Master instances and their versions; isolate affected systems from production networks if version 6.381 or earlier is confirmed. Within 7 days: Implement network-level restrictions (WAF rules blocking POST requests to upload endpoints, IP whitelisting); disable file upload functionality if operationally feasible; monitor logs for exploitation attempts. Within 30 days: Contact vendor for patch availability and timeline; evaluate migration to alternative solutions if patch remains unavailable; conduct forensic analysis of affected systems for signs of compromise.

Airleader Master CVE-2026-1358

CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-02-12 ics-cert@hq.dhs.gov

File Upload

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 12, 2026 - 22:16 nvd

CRITICAL 9.8

DescriptionCVE.org

Airleader Master versions 6.381 and prior allow for file uploads without restriction to multiple webpages running maximum privileges. This could allow an unauthenticated user to potentially obtain remote code execution on the server.