What is the CVSS score of CVE-2026-2577?

CVE-2026-2577 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Nanobot are affected by CVE-2026-2577?

A critical vulnerability in Nanobot's WhatsApp bridge exposes unauthenticated remote code execution to anyone with network access to port 3001.

How to fix or mitigate CVE-2026-2577?

Within 24 hours: Identify all systems running Nanobot with WhatsApp bridge enabled and isolate port 3001 from external/untrusted networks; disable the WhatsApp bridge component if not operationally critical. Within 7 days: Implement network segmentation to restrict port 3001 access to authorized systems only; deploy WAF rules to require authentication tokens; conduct forensic review for signs of compromise. Within 30 days: Monitor vendor for patch availability; develop exit strategy to migrate away from Nanobot if timeline for patch is unacceptable.

Nanobot CVE-2026-2577

CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-02-16 vulnreport@tenable.com

10.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Feb 16, 2026 - 10:16 nvd

CRITICAL 10.0

DescriptionCVE.org

The WhatsApp bridge component in Nanobot binds the WebSocket server to all network interfaces (0.0.0.0) on port 3001 by default and does not require authentication for incoming connections. An unauthenticated remote attacker with network access to the bridge can connect to the WebSocket server to hijack the WhatsApp session. This allows the attacker to send messages on behalf of the user, intercept all incoming messages and media in real-time, and capture authentication QR codes.

AnalysisAI

Nanobot WhatsApp bridge binds its WebSocket server to all interfaces (0.0.0.0) without authentication (CVSS 10.0), exposing the WhatsApp bridge to remote access.