Is there a public PoC exploit available for CVE-2026-7292?

Yes, a public proof-of-concept exploit is available for CVE-2026-7292. Prioritise patching immediately. EPSS: 0.0%.

o2oa CVE-2026-7292

Q: What is the CVSS score of CVE-2026-7292?

CVE-2026-7292 has a CVSS 4.0 base score of 2.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-26136 LOW

Improper Authorization (CWE-285)

2026-04-28 VulDB

Java Authentication Bypass

2.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.9 LOW

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:12 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:12 NVD

6.3 (MEDIUM) 2.9 (LOW)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

Analysis Generated

Apr 28, 2026 - 20:05 vuln.today

CVSS changed

Apr 28, 2026 - 19:52 NVD

5.6 (MEDIUM) 6.3 (MEDIUM)

EUVD ID Assigned

Apr 28, 2026 - 19:30 euvd

EUVD-2026-26136

Analysis Generated

Apr 28, 2026 - 19:30 vuln.today

CVE Published

Apr 28, 2026 - 17:30 nvd

LOW 2.9

DescriptionCVE.org

A security vulnerability has been detected in o2oa up to 10.0. This impacts the function syncFile of the file NodeAgent.java of the component NodeAgent. The manipulation leads to improper authorization. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitability is said to be difficult. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Improper authorization in o2oa up to version 10.0 allows remote attackers to bypass authentication via the syncFile function in NodeAgent.java, leading to unauthorized access to file operations. The vulnerability requires high attack complexity and has publicly available exploit code, though no active exploitation in the wild has been confirmed at this time.

Technical ContextAI

The vulnerability exists in the NodeAgent component of o2oa, specifically within the syncFile function of NodeAgent.java. This is a Java-based application and the issue stems from improper authorization checks (CWE-285: Improper Authorization) in the file synchronization mechanism. The NodeAgent component appears to handle inter-node file operations, and the lack of proper authorization controls allows attackers to manipulate file synchronization requests without proper permission validation. The remote network vector combined with lack of required user interaction suggests the syncFile endpoint is exposed to network callers.

RemediationAI

No vendor-released patch has been identified at time of analysis. Immediate mitigation steps include: restricting network access to the NodeAgent component and its syncFile endpoint through firewall rules or network segmentation, allowing only trusted inter-node communication; disabling or restricting the syncFile functionality if not actively required for operations; implementing network-level authentication or mutual TLS for NodeAgent communication to add an additional authorization layer beyond application logic; and monitoring NodeAgent logs for unusual syncFile requests with mismatched authorization headers or unexpected source IPs. Monitor the o2oa GitHub repository (https://github.com/o2oa/o2oa) and issue tracker (https://github.com/o2oa/o2oa/issues/194) for vendor patches or workarounds. Organizations should consider upgrading to versions beyond 10.0 once available and tested.