Is there a public PoC exploit available for EUVD-2026-21280?

Yes, a public proof-of-concept exploit is available for EUVD-2026-21280. Prioritise patching immediately. EPSS: 0.0%.

N A EUVD-2026-21280

Q: What is the CVSS score of EUVD-2026-21280?

EUVD-2026-21280 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-5999 LOW

Improper Authorization (CWE-285)

2026-04-10 VulDB

Authentication Bypass N A Jeecgboot

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 10, 2026 - 03:16 vuln.today

Public exploit code

EUVD ID Assigned

Apr 10, 2026 - 02:45 euvd

EUVD-2026-21280

Analysis Generated

Apr 10, 2026 - 02:45 vuln.today

CVE Published

Apr 10, 2026 - 01:45 nvd

MEDIUM 5.3

DescriptionCVE.org

A vulnerability has been found in JeecgBoot up to 3.9.1. This impacts an unknown function of the component SysAnnouncementController. Such manipulation leads to improper authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor confirmed the issue and will provide a fix in the upcoming release.

AnalysisAI

Improper authorization in JeecgBoot up to version 3.9.1 allows authenticated remote attackers to bypass access controls in the SysAnnouncementController component, potentially leading to unauthorized data modification and disclosure. The vulnerability has a CVSS score of 6.3 (medium severity) and carries an EPSS severity rating reflecting real-world exploitability; publicly available exploit code exists and the vendor has confirmed the issue with a patch expected in an upcoming release.

Technical ContextAI

The vulnerability exists in the SysAnnouncementController component of JeecgBoot, a Java-based low-code development framework. The root cause is classified under CWE-285 (Improper Authorization), indicating that the component fails to properly enforce access control policies. The CVSS vector AV:N/AC:L/PR:L shows the vulnerability is remotely exploitable with low attack complexity and requires low-level privileges (authenticated user context), suggesting the flaw resides in privilege escalation or role-based access control (RBAC) enforcement logic within the announcement management functionality. The component likely fails to validate whether an authenticated user has legitimate authorization to perform specific operations on announcement resources.

RemediationAI

Upgrade JeecgBoot to a version beyond 3.9.1 once the vendor releases a patched version; the vendor has confirmed the issue and committed to a fix in an upcoming release, though the specific version number is not yet disclosed in available data. Monitor the official JeecgBoot GitHub repository (https://github.com/jeecgboot/JeecgBoot/) and GitHub issue #9508 (https://github.com/jeecgboot/JeecgBoot/issues/9508) for release announcements. As an interim mitigation, restrict network access to JeecgBoot instances and limit authentication privileges for users who do not require announcement management capabilities, thereby reducing the attack surface to users with legitimate low-level access. Review audit logs for unauthorized announcement operations by authenticated users.