What is the CVSS score of CVE-2026-26682?

CVE-2026-26682 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Java are affected by CVE-2026-26682?

FastCMS versions prior to 0.1.6 contain a critical vulnerability enabling local attackers to execute arbitrary code through the PluginController component.

Is there a public PoC exploit available for CVE-2026-26682?

Yes, a public proof-of-concept exploit is available for CVE-2026-26682. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-26682?

Within 24 hours: Inventory all systems running fastCMS and identify affected versions below 0.1.6; disable plugin functionality if operationally feasible and implement access controls restricting local system access. Within 7 days: Evaluate upgrade feasibility to v0.1.6 or later; establish a patching timeline with business stakeholders and begin testing in non-production environments. Within 30 days: Complete upgrade deployment across all production systems or implement compensating controls if upgrade is blocked; document all affected systems and mitigation status for audit purposes.

Java CVE-2026-26682

HIGH

Code Injection (CWE-94)

2026-02-26 cve@mitre.org

Java Fastcms Xjd2020

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Mar 03, 2026 - 20:06 vuln.today

Public exploit code

CVE Published

Feb 26, 2026 - 18:23 nvd

HIGH 7.8

DescriptionCVE.org

An issue in fastCMS before v.0.1.6 allows a local attacker to execute arbitrary code via the PluginController.java component

AnalysisAI

Fastcms versions prior to 0.1.6 contain a code injection vulnerability in the PluginController component that allows local attackers with user-level privileges to execute arbitrary code with full system compromise. Public exploit code exists for this vulnerability, and no patch is currently available. Java environments running affected Fastcms instances are at risk of privilege escalation and complete system takeover.

Technical ContextAI

Classified as CWE-94 (Code Injection). Affects the PluginController.java component of Fastcms. An issue in fastCMS before v.0.1.6 allows a local attacker to execute arbitrary code via the PluginController.java component

RemediationAI

Monitor vendor advisories for a patch.

More in Java

View all

CVE-2012-4681 CRITICAL Emergency POC

9.8 Aug 28

Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m

CVE-2015-7450 CRITICAL Emergency POC

9.8 Jan 02

Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti

CVE-2013-2465 CRITICAL Act Now POC

9.8 Jun 18

Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent

CVE-2011-3544 CRITICAL Act Now POC

9.8 Oct 19

Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug

CVE-2010-1871 HIGH Act Now POC

8.8 Aug 05

JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to

CVE-2012-1723 CRITICAL Emergency POC

9.8 Jun 16

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up

CVE-2013-0422 CRITICAL Emergency POC

9.8 Jan 10

Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using

CVE-2012-0507 CRITICAL Emergency POC

9.8 Jun 07

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up

CVE-2015-4852 CRITICAL Act Now POC

9.8 Nov 18

The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers

CVE-2012-5076 CRITICAL Act Now POC

9.8 Oct 16

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow

CVE-2017-3066 CRITICAL Act Now POC

9.8 Apr 27

Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla

CVE-2012-0391 CRITICAL Act Now POC

9.8 Jan 08

The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during

Same weakness CWE-94 – Code Injection

View all

CVE-2023-3519 CRITICAL POC

9.8

CVE-2021-22205 CRITICAL POC

10.0

CVE-2012-0158 HIGH POC

8.8

CVE-2021-44529 CRITICAL POC

9.8

CVE-2014-6287 CRITICAL POC

9.8

CVE-2017-7494 CRITICAL POC

9.8

CVE-2013-3906 HIGH POC

7.8

CVE-2017-9822 HIGH POC

8.8

CVE-2026-26682 vulnerability details – vuln.today

Back

Java CVE-2026-26682

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Java

Same weakness CWE-94 – Code Injection

Share

External POC / Exploit Code