What’s Vulnerable › Vulnerabilities

CVE-2026-109360: MONAI 0.4.0 before 1.6.1 RCE via SENet Pretrained Weights Over Plaintext HTTP

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-12 · updated 2026-10-16
• Weakness: CWE-502

Description

MONAI 0.4.0 before 1.6.1 contains a remote code execution vulnerability that allows on-path attackers to execute code by tampering with SENet pretrained weights fetched over plaintext HTTP. Attackers can substitute a crafted .pth file that load_state_dict_from_url unpickles without weights_only=True, executing code when SEResNet50 or other SENet models are constructed with pretrained=True.

Affected products

• Project-MONAI MONAI: from 0.4.0 before 1.6.1 — fixed in 1.6.1

How to fix

Upgrade to a fixed version: Project-MONAI MONAI 1.6.1. Check the vendor advisory for mitigations.

References

• https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-vm9c-7j6g-c7mm
• https://www.vulncheck.com/advisories/monai-0.4.0-before-1.6.1-rce-via-senet-pretrained-weights-over-plaintext-http
• https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-vm9c-7j6g-c7mm

Get alerted when CVE-2026-109360 or the next vulnerability affects your stack