Mythic C2 CVE-2026-57952

Exploitation requires: (1) a valid authenticated operator-level account on the target Mythic instance - PR:L in CVSS 4.0 confirms authentication is required; (2) knowledge of a payload UUID belonging to a different operation on the same server - this is the primary complexity barrier (AC:H) and limits exploitation to scenarios where multiple operations share one Mythic deployment and the attacker can enumerate or obtain a foreign UUID. Exploitation is not possible against single-operation or single-team Mythic deployments where all operators belong to the same operation. The attacker needs no special OS-level privileges and no user interaction from a victim. The vulnerability is limited to confidentiality (read-only), so no configuration changes or payload modification are possible through this path alone.

Real-world risk is moderate but operationally significant given Mythic's red-team context. The CVSS 4.0 vector AV:N/AC:H/PR:L correctly captures that exploitation requires both authenticated operator access and foreknowledge of a cross-operation payload UUID - a non-trivial precondition. The high confidentiality impact (VC:H) is well-justified: C2 encryption keys and callback parameters constitute sensitive operational intelligence. No KEV listing and no known POC exist, keeping EPSS and empirical exploitation signals low. However, in shared Mythic deployments where multiple red teams or client engagements run on the same server, the threat from a malicious or compromised operator is realistic. The CVSS 4.0 score of 6.0 is defensible; this is not a trivially exploitable internet-facing vulnerability, but the impact to operational security in the affected niche is severe. No conflicting signals in the available data.

A red-team operator authenticated to a shared Mythic server for Operation A discovers or guesses a payload UUID belonging to Operation B (e.g., via log exposure, a misconfigured dashboard, or social engineering a colleague). The operator sends a crafted POST request to the c2profile_config_check_webhook endpoint with Operation B's UUID. Because the endpoint performs no ownership check, the server responds with Operation B's full C2 profile configuration, including encryption keys and callback parameters, which the attacker uses to decrypt intercepted C2 traffic or impersonate Operation B's implants. No public POC exists, but the technique requires only standard HTTP requests.