Which versions of OpenBullet2 are affected by CVE-2026-25856?

OpenBullet2 versions through 0.3.2 contain a critical remote code execution vulnerability that, combined with publicly available exploit code and known authentication bypass techniques, poses…

Is there a public PoC exploit available for CVE-2026-25856?

Yes, a public proof-of-concept exploit is available for CVE-2026-25856. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-25856?

Within 24 hours: Identify all systems running OpenBullet2 version 0.3.2 or earlier; immediately isolate from production networks or implement strict access controls on administrative interfaces; enable comprehensive logging of job execution and C# code submissions. Within 7 days: Since no vendor patch is available, initiate migration planning to alternative tools; forensically review system logs for indicators of unauthorized access or suspicious C# execution activity. Within 30 days: Complete migration away from all vulnerable OpenBullet2 versions (0.3.2 and earlier) or place in isolated, non-critical infrastructure pending vendor remediation.

OpenBullet2 CVE-2026-25856

Q: What is the CVSS score of CVE-2026-25856?

CVE-2026-25856 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-35135 HIGH

Code Injection (CWE-94)

2026-06-08 VulnCheck

GHSA-w8vj-qcv3-4w36

Code Injection RCE Openbullet2

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jun 08, 2026 - 17:31 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 08, 2026 - 17:30 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 08, 2026 - 17:22 vuln.today

cvss_changed

CVSS changed

Jun 08, 2026 - 17:22 NVD

8.8 (HIGH) 8.7 (HIGH)

Analysis Generated

Jun 08, 2026 - 17:21 vuln.today

DescriptionCVE.org

OpenBullet2 through version 0.3.2 contains an authenticated remote code execution vulnerability that allows authenticated users to execute arbitrary C

code on the server host by creating or modifying job configurations. Attackers can leverage the plain C

execution mode, which lacks reference filtering or API restrictions, to access the file system, spawn processes, and invoke arbitrary .NET APIs as the process user.

AnalysisAI

Authenticated remote code execution in OpenBullet2 through version 0.3.2 allows any logged-in user to run arbitrary C

code on the host by abusing the job configuration interface's plain C

execution mode. Because that mode lacks reference filtering or API restrictions, attackers can touch the file system, spawn child processes, and call any .NET API as the OpenBullet2 service account. Publicly available exploit code exists, and the issue was reported by VulnCheck; pairing it with a known authentication bypass route (referenced HackerNoon write-up) materially raises real-world exploitability.

Technical ContextAI

OpenBullet2 is an open-source web automation and request-replay suite (commonly abused for credential stuffing) built on .NET. CWE-94 (Improper Control of Generation of Code, 'Code Injection') captures the root cause: job configurations accept user-supplied C

that is compiled and executed in-process without an allowlist of namespaces, assemblies, or APIs. Because the runtime is .NET, an attacker's code runs with full access to System.IO, System.Diagnostics.Process, reflection, and P/Invoke - effectively the same trust level as the OpenBullet2 worker. The affected CPE is cpe:2.3:a:openbullet:openbullet2:::::::: with all versions up to and including 0.3.2 in scope.

RemediationAI

No vendor-released patch identified at time of analysis - upgrade to any post-0.3.2 release the maintainers publish that explicitly addresses CWE-94 in the job configuration code path, and monitor the VulnCheck advisory (https://www.vulncheck.com/advisories/openbullet2-authenticated-rce-via-job-configuration-interface) for fix coordinates. Until a fix ships, do not expose the OpenBullet2 web UI to the public internet: bind it to localhost and reach it via SSH tunnel or VPN, or place it behind an authenticating reverse proxy with IP allowlisting (trade-off: breaks remote operator workflows). Within the application, restrict who can create or edit job configurations to a single trusted admin account, rotate any shared operator credentials, and run the OpenBullet2 process as a low-privilege user inside a container or sandbox so that successful code injection cannot pivot to the underlying host (trade-off: containerization adds operational overhead). Also review for the empty-header auth bypass behavior described in the HackerNoon writeup, since that turns this authenticated RCE into a pre-auth one if present.