CAYIN CMS CVE-2026-80233

Exploitation requires the attacker to hold high-privileged credentials (PR:H per CVSS 4.0 vector) on one of the affected CAYIN CMS platforms - unauthenticated access is not sufficient. The CMS management interface must be network-accessible from the attacker's position (AV:N). The file upload feature must be available to the authenticated session. Limiting factors: the PR:H requirement means an attacker without prior admin-level access cannot exploit this directly; no user interaction from a victim is needed once credentials are obtained (UI:N); no special race condition or configuration toggle is indicated. Scope change to other systems is not modeled (SC:N), so impact is contained to the compromised CMS server itself.

The CVSS 4.0 score of 8.6 reflects severe potential impact (VC:H/VI:H/VA:H) but is tempered by a critical prerequisite: PR:H (high privileges required), meaning the attacker must already hold an administrative or highly privileged account on the CMS platform before exploitation is possible. EPSS at 0.62% (47th percentile) is low, consistent with SSVC's 'Exploitation: none' assessment - no active exploitation is being observed. SSVC marks 'Automatable: no,' aligning with the PR:H barrier that prevents mass scanning-style exploitation. Despite 'Technical Impact: total,' the realistic threat is constrained to scenarios involving insider threat, compromised admin credentials, or social engineering of a privileged user. This is not a spray-and-pray vulnerability - the PR:H requirement is a genuine limiting factor. The CVSS 4.0 vector's SC:N/SI:N/SA:N indicates no lateral scope change to subsequent systems is modeled.

An attacker who has obtained or compromised a privileged CAYIN CMS administrator account - through credential theft, phishing, or reuse - authenticates to the web management interface and submits a crafted file (e.g., a PHP or ASP web shell) via the file upload feature. The server accepts and stores the file without type validation, and the attacker then browses to the uploaded shell's URL to issue arbitrary OS commands, gaining full control of the server. No public proof-of-concept code is known at time of analysis, but the attack pattern is well-understood and straightforward once privileged access is obtained.