Is there a public PoC exploit available for CVE-2026-7600?

Yes, a public proof-of-concept exploit is available for CVE-2026-7600. Prioritise patching immediately. EPSS: 0.7%.

yii2-mcp-server CVE-2026-7600

Q: What is the CVSS score of CVE-2026-7600?

CVE-2026-7600 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.7%.

EUVD-2026-26725 LOW

OS Command Injection (CWE-78)

2026-05-02 VulDB

Command Injection

2.1

CVSS 4.0

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

May 02, 2026 - 01:22 NVD

MEDIUM LOW

CVSS changed

May 02, 2026 - 01:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

PoC Detected

May 02, 2026 - 01:16 vuln.today

Public exploit code

Analysis Generated

May 02, 2026 - 01:00 vuln.today

EUVD ID Assigned

May 02, 2026 - 00:30 euvd

EUVD-2026-26725

Analysis Generated

May 02, 2026 - 00:30 vuln.today

CVE Published

May 02, 2026 - 00:15 nvd

LOW 2.1

DescriptionNVD

A flaw has been found in ArtMin96 yii2-mcp-server 1.0.2. This impacts the function yii_command_help/yii_execute_command of the file src/index.ts of the component MCP Interface. Executing a manipulation can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Remote OS command injection in ArtMin96 yii2-mcp-server 1.0.2 allows authenticated remote attackers to execute arbitrary operating system commands via manipulation of the yii_command_help or yii_execute_command functions in the MCP Interface component. Exploit code is publicly available, and the vendor has not yet responded to early disclosure through issue reporting.

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

CVE-2026-7600 vulnerability details – vuln.today

Back