Is there a public PoC exploit available for CVE-2026-5259?

Yes, a public proof-of-concept exploit is available for CVE-2026-5259. Prioritise patching immediately. EPSS: 0.0%.

Java CVE-2026-5259

Q: What is the CVSS score of CVE-2026-5259?

CVE-2026-5259 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-17826 LOW

Server-Side Request Forgery (SSRF) (CWE-918)

2026-04-01 VulDB

Java SSRF Frostmourne

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 01, 2026 - 14:23 vuln.today

Public exploit code

EUVD ID Assigned

Apr 01, 2026 - 08:00 euvd

EUVD-2026-17826

Analysis Generated

Apr 01, 2026 - 08:00 vuln.today

CVE Published

Apr 01, 2026 - 07:30 nvd

MEDIUM 5.3

DescriptionCVE.org

A vulnerability was determined in AutohomeCorp frostmourne up to 1.0. The affected element is an unknown function of the file frostmourne-monitor/src/main/java/com/autohome/frostmourne/monitor/controller/AlarmController.java of the component Alarm Preview. Executing a manipulation can lead to server-side request forgery. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

Server-side request forgery in AutohomeCorp frostmourne up to version 1.0 allows authenticated remote attackers to manipulate the Alarm Preview component via an unknown function in AlarmController.java, enabling arbitrary HTTP requests from the vulnerable server with potential to access internal resources, leak sensitive data, or interact with backend systems. Publicly available exploit code exists; CVSS 6.3 reflects moderate severity with low attack complexity and limited impact scope.

Technical ContextAI

The vulnerability stems from improper input validation in the Alarm Preview functionality of frostmourne's AlarmController.java component, classified as CWE-918 (Server-Side Request Forgery). frostmourne is a distributed alarm platform written in Java, and the SSRF flaw allows attackers to craft requests that the server processes on behalf of the attacker, bypassing network segmentation and accessing internal services, metadata endpoints (e.g., cloud provider IMDSv1), or adjacent systems. The affected product is identified by CPE cpe:2.3:a:autohomecorp:frostmourne:*:*:*:*:*:*:*:*, indicating all versions up to and including 1.0 are vulnerable.

RemediationAI

Upgrade to a patched version of frostmourne released by AutohomeCorp after version 1.0 (exact version not specified in available data; vendor advisory should be consulted). In the interim, implement network-level restrictions to limit outbound HTTP/HTTPS requests from the frostmourne application server, enforce strict input validation and URL schema whitelisting in the Alarm Preview endpoint, restrict the feature to trusted internal users only, and consider disabling the Alarm Preview component if not essential. Consult VulDB (https://vuldb.com/vuln/354449) for the latest vendor guidance and patch availability confirmation.