66Uptime CVE-2026-39117

Exploitation requires a network-reachable deployment of AltumCode 66Uptime before v54.0.0 (or the 66Uptime ping-servers plugin before v2.0.0) with the index.php entry point exposed; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special privileges are needed against default configurations. The specific limiting factor is the small deployment base of this commercial monitoring script. A material caveat: the referenced advisory frames the ping-servers plugin flaw as SSRF, which if accurate would require the ping/monitoring feature that issues outbound requests to be reachable, and would limit impact to server-side request forgery rather than full code execution - confirm the exact affected feature and vulnerability class with the vendor.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8 critical) describes unauthenticated remote code execution against a network-facing entry point (index.php), with total technical impact confirmed by the SSVC framework (Technical Impact: total). SSVC also marks Automatable: yes, meaning the attack can be reliably scripted, which raises real-world concern for opportunistic mass exploitation IF the product were widely deployed. SSVC Exploitation status is 'poc' - indicating publicly available exploit code exists - but there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of confirmed active exploitation in the wild. A significant CONFLICT exists in the source data: the CVE is classified CWE-94 (Code Injection / RCE) with a 9.8 RCE vector and PHP/RCE/Code Injection tags, yet the only reference (glimmernet.com advisory GT-2026-001) is explicitly titled an SSRF advisory for the 66Uptime ping-servers plugin - SSRF and unauthenticated RCE are materially different vulnerability classes with different impact profiles. This discrepancy should be resolved with the vendor/advisory before treating the full 9.8 RCE rating as confirmed. Net: if the RCE classification is accurate, this is a genuine high-priority flaw (unauthenticated, automatable, total impact), but the low deployment footprint of 66Uptime and the RCE-vs-SSRF source conflict temper the practical urgency.

A remote unauthenticated attacker sends a crafted HTTP request to the application's index.php endpoint that injects attacker-controlled code, which the vulnerable 66Uptime / ping-servers plugin code evaluates and executes on the server (CWE-94). Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials or user interaction are needed, and SSVC indicates a public proof-of-concept exists and the attack is automatable. Note: the linked advisory characterizes the ping-servers issue as SSRF rather than direct code execution, so the realistic outcome may be server-side request forgery pivoting rather than immediate RCE - verify against the vendor advisory.