CVE-2026-26718

9.1 criticalEPSS 0.2%

Critical (9.1). EPSS 0.2% chance of exploitation in the next 30 days.

A Cross-Site Request Forgery (CSRF) vulnerability exists in the xxl-job-admin web application v.3.0.0 that allows an attacker to perform unauthorized modifications to Glue IDE shell scripts. The affected endpoint lacks proper CSRF token validation and accepts arbitrary HTTP methods via a permissive request mapping

Severity

CVSS 3.1

9.1 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 12% of CVEs (scores of 2026-10-31)
CWE: CWE-352
Published: 2026-07-15
Modified: 2026-07-16
Record from: the NVD, synced 2026-10-19

References

https://github.com/Ibrahim-Sartawi/CVE-2026-26718
https://xxl-job-admin.com
https://github.com/Ibrahim-Sartawi/CVE-2026-26718

Check your stack JSON