Which versions of Cockpit CMS are affected by CVE-2026-34965?

Cockpit CMS vulnerability allows authenticated users with collection-management privileges to execute arbitrary code on production servers, enabling data theft, service disruption, and potential…

Is there a public PoC exploit available for CVE-2026-34965?

Yes, a public proof-of-concept exploit is available for CVE-2026-34965. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-34965?

Within 24 hours, audit and document all users and service accounts holding collection-management privileges in Cockpit CMS; revoke access for users who do not require it, and verify no inactive or compromised accounts retain this role. Within 7 days, implement network-level access controls to restrict exposure of the /cockpit/collections/save_collection endpoint, deploy request logging and monitoring to detect suspicious POST requests with PHP syntax in rule parameters, and configure the application server to run with minimal OS privileges. Within 30 days, contact Cockpit CMS vendor to request patch timeline, evaluate alternative CMS platforms, and develop a migration or upgrade plan to remediate this vulnerability.

Cockpit CMS CVE-2026-34965

Q: What is the CVSS score of CVE-2026-34965?

CVE-2026-34965 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-26280 HIGH

Code Injection (CWE-94)

2026-04-29 VulnCheck

RCE Code Injection PHP Cockpit Cms

8.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable admin endpoint with no user interaction; a low-privilege collection-management account is required (PR:L), and PHP code execution yields full C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 01:27 vuln.today

PoC Detected

Apr 29, 2026 - 21:22 vuln.today

Public exploit code

CVSS changed

Apr 29, 2026 - 20:22 NVD

8.8 (HIGH) 8.7 (HIGH)

EUVD ID Assigned

Apr 29, 2026 - 20:00 euvd

EUVD-2026-26280

CVE Published

Apr 29, 2026 - 19:50 nvd

HIGH 8.7

DescriptionCVE.org

Cockpit CMS contains an authenticated remote code execution vulnerability in the /cockpit/collections/save_collection endpoint that allows authenticated attackers with collection management privileges to inject arbitrary PHP code into collection rules parameters. Attackers can inject malicious PHP code through rule parameters which is written directly to server-side PHP files and executed via include() to achieve arbitrary command execution on the underlying server.

AnalysisAI

Authenticated remote code execution in Cockpit CMS lets attackers holding collection-management privileges inject arbitrary PHP through the /cockpit/collections/save_collection endpoint's rule parameters, which are persisted to server-side PHP files and executed via include(). A low-privileged authenticated user can therefore run arbitrary OS commands on the host. Publicly available exploit code exists (VulnCheck advisory and a public gist), though this is not listed in CISA KEV; EPSS is modest at 0.39% (60th percentile).

Technical ContextAI

Cockpit CMS (agentejo/cockpit) is a PHP-based headless/API-driven content management system that stores collection definitions - including field validation and access 'rules' - as executable PHP. The flaw is a CWE-94 Code Injection: user-supplied rule parameters submitted to save_collection are written verbatim into a server-side PHP file and later loaded with include(), so any PHP syntax in those rules becomes live code at evaluation time. Because rules are meant to be small logic snippets stored as code rather than data, the input is never neutralized before it reaches the PHP interpreter, turning a data-management feature into an arbitrary code execution primitive.

RemediationAI

Upstream fix available (PR/commit); a released, tagged patched version is not independently confirmed from the provided data - the fix is associated with commit 494765e4f0fb9484f320aee0c6ee889b6fa789b9 (https://github.com/agentejo/cockpit/commits/494765e4f0fb9484f320aee0c6ee889b6fa789b9), so update to a build at or after that commit and review the VulnCheck advisory (https://www.vulncheck.com/advisories/cockpit-cms-authenticated-remote-code-execution-via-collections). Until a patched build is deployed, restrict who holds collection-management privileges to a minimal set of fully trusted operators, since PR:L means the exploit requires that role; place the /cockpit admin interface (and specifically the collections/save_collection endpoint) behind a VPN, IP allowlist, or reverse-proxy authentication so it is not internet-reachable - trade-off is reduced remote administrative convenience. If feasible, run the PHP process as a low-privilege user with a read-only or non-executable data directory to blunt the include()-based execution, accepting that this may break features that legitimately regenerate collection PHP files. Monitor for unexpected new or modified PHP files in the collections storage path as a detection control.