Is there a public PoC exploit available for CVE-2026-6564?

Yes, a public proof-of-concept exploit is available for CVE-2026-6564. Prioritise patching immediately. EPSS: 0.0%.

Emqx Enterprise CVE-2026-6564

Q: What is the CVSS score of CVE-2026-6564?

CVE-2026-6564 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-23692 LOW

Improper Authorization (CWE-285)

2026-04-19 VulDB

GHSA-vqmj-h423-xx64

Authentication Bypass Emqx Enterprise

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:12 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:12 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

CVSS changed

Apr 19, 2026 - 10:22 NVD

4.3 (MEDIUM) 5.3 (MEDIUM)

Analysis Generated

Apr 19, 2026 - 10:04 vuln.today

EUVD ID Assigned

Apr 19, 2026 - 10:00 euvd

EUVD-2026-23692

Analysis Generated

Apr 19, 2026 - 10:00 vuln.today

CVE Published

Apr 19, 2026 - 09:30 nvd

LOW 2.1

DescriptionCVE.org

A vulnerability was found in EMQ EMQX Enterprise up to 6.1.0. The impacted element is an unknown function of the component Session Handling. The manipulation results in improper authorization. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Improper authorization in EMQ EMQX Enterprise 6.0-6.1.0 allows authenticated remote attackers to trigger a denial-of-service condition via unspecified manipulation of the Session Handling component. CVSS 4.3 with attack vector AV:N/AC:L/PR:L reflects network-exploitable impact limited to availability; publicly available exploit code exists but active exploitation has not been confirmed by CISA KEV. The vendor has not responded to early disclosure notification.

Technical ContextAI

EMQ EMQX Enterprise is a scalable, distributed MQTT message broker (cpe:2.3:a:emq:emqx_enterprise:*:*:*:*:*:*:*:*). MQTT (Message Queuing Telemetry Transport) is a publish-subscribe protocol commonly used in IoT and messaging infrastructure. The vulnerability resides in the Session Handling component, which manages client connection state, authentication tokens, and authorization policies. CWE-285 (Improper Authorization) indicates the root cause is a logic flaw in access control decision-making-specifically, the Session Handling code fails to properly enforce authorization checks, allowing authenticated users to perform actions or access resources beyond their intended scope. The CVSS vector PR:L (requires low privilege) confirms exploitation requires valid credentials, but the 'improper authorization' classification suggests an authenticated attacker can escalate or bypass intended restrictions within their session context.

RemediationAI

Upgrade EMQ EMQX Enterprise to a patched version released by EMQ post-2026. No specific patch version number is provided in the available data; contact EMQ Support directly or check https://www.emqx.io/docs/en/latest/install/install-enterprise.html for the latest security release. As a temporary compensating control pending patching, restrict network access to the EMQX broker to trusted clients and networks only using firewall rules or network segmentation-whitelist source IPs and close unnecessary ports (default MQTT 1883, WebSocket 8083). Implement role-based access control (RBAC) within EMQX to limit authenticated user permissions to the minimum required for their application; audit and revoke inactive or unnecessary credentials. Monitor session activity logs for anomalous connection patterns or repeated session failures that may indicate exploitation attempts. These controls reduce both the attack surface and the severity of a potential DoS impact.