Mythic C2 EUVD-2026-40138

Exploitation requires a valid Mythic account assigned the spectator role - a low-privilege role intended for read-only observation of C2 operations. The attacker must have network access to the Mythic server and be authenticated (PR:L per the CVSS 4.0 vector). The vulnerable endpoint is specifically eventing_import_automatic_webhook, which must be reachable and present in the deployed Mythic version (any release before 3.4.0.60). No additional special configuration beyond a standard Mythic deployment is required. Exploitation is limited by the mandatory spectator-role credential requirement - unauthenticated external attackers cannot exploit this directly. Deployments with no spectator accounts provisioned are not at practical risk.

The CVSS 4.0 base score of 5.3 (Medium) with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L reflects a realistic moderate risk. The PR:L requirement is the primary limiting factor - exploitation is gated on valid spectator-role credentials, which meaningfully narrows the attack surface to insiders, compromised accounts, or scenarios where spectator access is loosely granted. No KEV listing confirms this is not known to be actively exploited at time of analysis, and no POC is referenced in the provided intelligence. EPSS data was not included in the input, so exploitation probability cannot be quantified from that signal. The VI:L and VA:L impacts are low individually, but in the specific operational context of a C2 framework, unauthorized modification of automation workflows and EventGroups could disrupt live red team engagements, inject malicious automation steps into an active operation, or destroy evidence of prior activity - risks that are contextually more significant than the raw score implies for security operations teams running Mythic in production. No conflicting signals between data sources were observed.

An attacker or malicious insider holding a spectator-role account in a Mythic deployment sends crafted HTTP POST requests directly to the eventing_import_automatic_webhook endpoint, bypassing the intended role enforcement at the middleware layer. Using this access, they create unauthorized automation workflows or delete existing EventGroups, potentially injecting rogue automation into an active red team operation or sabotaging operational continuity. No special tooling is required beyond standard HTTP request capabilities and valid spectator credentials.