What is the CVSS score of CVE-2026-26234?

CVE-2026-26234 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2026-26234?

Yes, a public proof-of-concept exploit is available for CVE-2026-26234. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-26234?

Within 24 hours: Inventory all Smart Visu Server instances and their firmware versions; isolate or restrict network access to affected systems if possible. Within 7 days: Implement WAF rules to block or sanitize X-Forwarded-Host headers; deploy network segmentation to limit lateral movement from compromised servers. Within 30 days: Monitor vendor communications closely for patch availability; conduct security assessment of all affected systems for signs of exploitation; develop and test migration or upgrade strategy.

Smart Visu Server Firmware CVE-2026-26234

HIGH

Improper Neutralization of HTTP Headers for Scripting Syntax (CWE-644)

2026-02-12 disclosure@vulncheck.com

Code Injection Smart Visu Server Firmware Jung Group

8.8

CVSS 3.1 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Craft HTTP request with malicious X-Forwarded-Host header
Delivery

Send to JUNG Smart Visu Server
Exploit

Server processes header as trusted proxy origin
Execution

Poison cache or generate phishing response
Impact

User receives tainted content from attacker domain

Vulnerability Assessment

Weakness	CWE CWE-644 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization HTTP header neutralization
Exploitation Conditions	JUNG Smart Visu Server version 1.1.1050 with default configuration trusting X-Forwarded-Host headers from any network source. No authentication required. Requires user interaction (UI:R) to click malicious link or access cached poisoned content.
Impact	CVSS 8.8 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: None. User interaction: Required. Exploitation no authentication required. Public exploit/POC available.
Exploit ScenarioDerived	An attacker without authentication could exploit this vulnerability to override request URLs by injecting arbitrary values in the X-Forwarded-Host head.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Smart Visu Server Firmware contains a vulnerability that allows attackers to override request URLs by injecting arbitrary values in the X-Forwarded-Host head (CVSS 8.8).

RemediationAI

Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

affects Smart Visu Server Firmware. JUNG Smart Visu Server 1.1.1050 contains a request header manipulation vulnerability that allows unauthenticated attackers to override request URLs by injecting arbitrary values in the X-Forwarded-Host header. Attackers can manipulate proxied requests to generate tainted responses, enabling cache poisoning, potential phishing, and redirecting users to malicious domains.

Know when Smart Visu Server Firmware gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

PoC Detected

Feb 20, 2026 - 15:14 vuln.today

Public exploit code

CVE Published

Feb 12, 2026 - 04:15 nvd

HIGH 8.8

DescriptionCVE.org

JUNG Smart Visu Server 1.1.1050 contains a request header manipulation vulnerability that allows unauthenticated attackers to override request URLs by injecting arbitrary values in the X-Forwarded-Host header. Attackers can manipulate proxied requests to generate tainted responses, enabling cache poisoning, potential phishing, and redirecting users to malicious domains.

Executive ViewAI

Why It Matters

A critical vulnerability in Smart Visu Server Firmware (CVE-2026-26234) enables attackers to manipulate request URLs through header injection, potentially allowing unauthorized access, credential theft, or malicious redirects. Public exploits are already available, creating immediate risk to all organizations running affected firmware versions without compensating controls in place.

Business Impact: Severe

Compensating Controls

Deploy Web Application Firewall (WAF) rules to reject or sanitize X-Forwarded-Host headers; implement reverse proxy header validation to whitelist trusted hosts only; segment Smart Visu Server network access using firewall policies; disable header-based URL redirection if functionality permits; enforce strict authentication and session management; implement continuous monitoring and logging of header-based requests for anomaly detection.

Threat Intelligence Overview

EPSS Score

0.0%

Top 93% exploitable

Exploit

POC

Public exploit code exists

Data Quality

3 sources

Confidence: Low

NVD

CVE.org

EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC Yes

EPSS 0.0%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Out-of-Cycle

Exploitation· derived

Poc

System Exposure· derived

Open

Automatable· derived

Human Impact

Very High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +44

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Code Injection CRITICAL

Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.