What is the CVSS score of CVE-2026-27466?

CVE-2026-27466 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L. EPSS exploitation probability: 0.1%.

Which versions of Ubuntu are affected by CVE-2026-27466?

BigBlueButton virtual classroom servers running version 3.0.21 or earlier are vulnerable to denial-of-service attacks through misconfigured ClamAV presentation file scanning, potentially disrupting…. A patch is available.

Is there a public PoC exploit available for CVE-2026-27466?

Yes, a public proof-of-concept exploit is available for CVE-2026-27466. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-27466?

Within 24 hours: Identify all BigBlueButton instances and confirm versions currently deployed. Within 7 days: Apply available vendor patch to all affected BigBlueButton servers (version 3.0.22 or later). Within 30 days: Validate patch deployment across all environments and verify ClamAV integration is properly configured per updated documentation.

Ubuntu CVE-2026-27466

HIGH

Exposure of Resource to Wrong Sphere (CWE-668)

2026-02-21 security-advisories@github.com

Ubuntu Docker Denial Of Service Bigbluebutton

7.2

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:04 vuln.today

PoC Detected

Feb 26, 2026 - 18:59 vuln.today

Public exploit code

Patch released

Feb 26, 2026 - 18:59 nvd

Patch available

CVE Published

Feb 21, 2026 - 08:16 nvd

HIGH 7.2

DescriptionGitHub Advisory

BigBlueButton is an open-source virtual classroom. In versions 3.0.21 and below, the official documentation for "Server Customization" on Support for ClamAV as presentation file scanner contains instructions that leave a BBB server vulnerable for Denial of Service. The flawed command exposes both ports (3310 and 7357) to the internet. A remote attacker can use this to send complex or large documents to clamd and waste server resources, or shutdown the clamd process. The clamd documentation explicitly warns about exposing this port. Enabling ufw (ubuntu firewall) during install does not help, because Docker routes container traffic through the nat table, which is not managed or restricted by ufw. Rules installed by ufw in the filter table have no effect on docker traffic. In addition, the provided example also mounts /var/bigbluebutton with write permissions into the container, which should not be required. Future vulnerabilities in clamd may allow attackers to manipulate files in that folder. Users are unaffected unless they have opted in to follow the extra instructions from BigBlueButton's documentation. This issue has been fixed in version 3.0.22.

AnalysisAI

BigBlueButton versions 3.0.21 and below allow remote denial of service when ClamAV is configured following official documentation, as the exposed clamd ports (3310, 7357) can be targeted by attackers to send malicious documents that exhaust server resources or crash the scanning service. This vulnerability affects Ubuntu and Docker deployments since standard firewall rules do not restrict container traffic, and public exploit code exists. An unauthenticated remote attacker requires only network access to trigger the denial of service condition.

Technical ContextAI

Classified as CWE-668 (Exposure of Resource to Wrong Sphere). Affects Bigbluebutton. BigBlueButton is an open-source virtual classroom. In versions 3.0.21 and below, the official documentation for "Server Customization" on Support for ClamAV as presentation file scanner contains instructions that leave a BBB server vulnerable for Denial of Service. The flawed command exposes both ports (3310 and 7357) to the internet. A remote attacker can use this to send complex or large documents to clamd and waste server resources, or shutdown the clamd process. The clamd documentation expli