What is the CVSS score of CVE-2026-67688?

CVE-2026-67688 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of ICS-Park Smart Park are affected by CVE-2026-67688?

ICS-Park Smart Park Management System v2.0 contains a critical remote code execution vulnerability (CVE-2026-67688, CVSS 9.8) that allows attackers to upload and execute arbitrary code through the…

Is there a public PoC exploit available for CVE-2026-67688?

Yes, a public proof-of-concept exploit is available for CVE-2026-67688. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-67688?

Within 24 hours: Immediately inventory all ICS-Park v2.0 instances across production and development environments; disable or restrict network access to the file upload module if operationally feasible; enable comprehensive logging and alerting on file upload attempts and system execution events. Within 7 days: Deploy Web Application Firewall (WAF) rules to block suspicious file uploads and restrict uploads to whitelisted file types; implement strict input validation and file execution restrictions; if possible, limit upload access to authenticated administrative users only; scan all instances for signs of prior compromise. Within 30 days: Monitor vendor ICS-Park for patch release and commit to immediate deployment once available; evaluate upgrade feasibility to patched versions; if no patch emerges within 90 days, initiate architectural assessment to replace the vulnerable file upload functionality or migrate to alternative parking management solutions.

ICS-Park Smart Park CVE-2026-67688

EUVD-2026-54309 CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-08-06 cve@mitre.org

GHSA-r6gv-mg3v-cx2f

RCE File Upload

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable upload endpoint with no interaction and low complexity yields RCE, so AV:N/AC:L/PR:N/UI:N and full C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 07, 2026 - 16:25 vuln.today

CVE Published

Aug 06, 2026 - 22:18 cve.org

CRITICAL 9.8

CVE Published

Aug 06, 2026 - 22:18 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

ICS-Park Smart Park Management System v2.0 contains an unrestricted file upload vulnerability in the file upload module. This allows a remote attacker to execute arbitrary code.

AnalysisAI

Unrestricted file upload in ICS-Park Smart Park Management System v2.0 lets a remote attacker upload and execute arbitrary code through the product's file upload module, yielding full server compromise (CVSS 9.8). Public exploit code exists and the flaw is automatable with total technical impact per CISA SSVC, though the EPSS probability remains low at 0.26% (17th percentile), indicating limited observed exploitation activity so far. No CISA KEV listing means no confirmed active exploitation at time of analysis.

Technical ContextAI

The vulnerability is a classic CWE-434 (Unrestricted Upload of File with Dangerous Type) defect: the file upload module fails to validate the type, extension, or content of uploaded files, allowing a server-side executable (e.g. a web shell in the application's server-side language) to be written into a web-accessible directory and then invoked. ICS-Park Smart Park Management System is a smart-park / campus facility management web application; because the product is delivered as a network-facing web application, an uploaded script executes in the web server's runtime context, translating a file-write primitive into remote code execution. Precise underlying technology stack, upload endpoint path, and storage location are not disclosed in the available intelligence.

RemediationAI

No vendor-released patch identified at time of analysis, and no fixed version is published in NVD or EUVD, so remediation must rely on compensating controls. Restrict network reachability of the application - place it behind a VPN or IP allowlist so the upload endpoint is not internet-exposed. At a reverse proxy or WAF, block or filter POST requests to the file upload module and deny requests for executable/script file types (e.g. .php, .jsp, .asp, .aspx) in upload paths; the trade-off is that legitimate document uploads of those types will break. Configure the web server so the upload storage directory is non-executable (serve as static content only, with script handlers disabled) - this neutralizes web-shell execution but does not stop the upload itself. Monitor the upload directory for newly written server-side scripts and enforce authentication in front of the module. Track the vendor and the NVD page (https://nvd.nist.gov/vuln/detail/CVE-2026-67688) for an official fixed release and apply it once available.