Which versions of Windows-MCP are affected by CVE-2026-48989?

Organizations using CursorTouch Windows-MCP face immediate risk from unauthenticated remote code execution that allows attackers to execute commands with full system privileges without credentials.. A patch is available.

How to fix or mitigate CVE-2026-48989?

Within 24 hours: Identify all CursorTouch Windows-MCP deployments running versions before 0.7.5 and restrict HTTP access via network firewall rules; enable comprehensive logging of control plane activity. Within 7 days: Deploy authentication controls (WAF/API gateway) in front of vulnerable instances; disable wildcard CORS configuration and restrict to specific trusted origins; segment systems from critical infrastructure. Within 30 days: Monitor vendor advisories for availability of version 0.7.5 release; perform immediate upgrade upon availability and validate patch through testing.

Windows-MCP CVE-2026-48989

Q: What is the CVSS score of CVE-2026-48989?

CVE-2026-48989 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

HIGH

Missing Authentication for Critical Function (CWE-306)

2026-06-17 GitHub_M

GHSA-vrxg-gm77-7q5g

Authentication Bypass Microsoft Windows Mcp

8.9

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

HTTP control plane is network-reachable with wildcard CORS and no auth provider, and the PowerShell tool yields full C/I/A impact within the user's security context, so no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 17, 2026 - 22:15 vuln.today

Analysis Generated

Jun 17, 2026 - 22:15 vuln.today

CVE Published

Jun 17, 2026 - 21:02 cve.org

HIGH 8.9

DescriptionCVE.org

Windows-MCP is an open-source project that integrates AI agents with Windows. In versions prior to 0.7.5, certain HTTP modes exposed the MCP control plane without authentication while enabling wildcard CORS (allow_origins=*, allow_methods=*, allow_headers=*). Because the same server also exposed a PowerShell tool that executes caller-controlled commands as the Windows user running Windows-MCP, attackers could reach the control plane from arbitrary origins or non-browser clients and achieve arbitrary PowerShell execution. This issue was fixed in version 0.7.5.

AnalysisAI

Unauthenticated remote PowerShell execution in CursorTouch Windows-MCP prior to version 0.7.5 allows attackers to reach the MCP control plane over HTTP and invoke the built-in PowerShell tool as the Windows user running the server. The flaw stems from SSE and streamable-http transports being built without an auth provider while wildcard CORS (allow_origins=*) is applied, opening the path to cross-origin browser pages and any non-browser HTTP client. No CISA KEV listing exists, but the CVSS 4.0 vector includes E:P, indicating publicly available exploit code exists.

Technical ContextAI

Windows-MCP is a Python Model Context Protocol server (pip package windows-mcp, CPE cpe:2.3:a:cursortouch:windows-mcp) that bridges AI agents to a Windows host. The HTTP entrypoints in src/windows_mcp/__main__.py instantiate FastMCP without an authentication provider and wrap it in an OptionsMiddleware/CORSMiddleware that unconditionally emits Access-Control-Allow-Origin/Methods/Headers: *. The exposed PowerShell tool (src/windows_mcp/tools/shell.py, desktop/powershell.py) forwards caller-controlled strings to PowerShell -EncodedCommand, so the auth gap is directly weaponizable. CWE-306 (Missing Authentication for Critical Function) is the root class; the fail-open composition of no auth plus wildcard CORS plus no Host validation also enables DNS rebinding against localhost-bound instances.

RemediationAI

Vendor-released patch: 0.7.5 - upgrade via uvx windows-mcp@0.7.5 serve or pip install --upgrade windows-mcp as documented at https://github.com/CursorTouch/Windows-MCP/releases/tag/v0.7.5. If upgrade is not immediately possible, switch the deployment to the default stdio transport which is not affected, or bind the HTTP listener to 127.0.0.1 and place it behind an authenticating reverse proxy that also strips Access-Control-Allow-Origin: * and validates the Host header to block DNS rebinding (trade-off: breaks any legitimate cross-origin browser client). After upgrading, operators who genuinely need browser clients should opt in explicitly with --cors-origins (or WINDOWS_MCP_CORS_ORIGINS / cors_origins in ~/.windows-mcp/config.toml) listing only trusted origins, since 0.7.5 also adds automatic TrustedHostMiddleware based on the bind address.