CVE-2026-13014: Remote Code Execution vulnerability in "Suspicious" application

Severity: critical (CVSS 9.2 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-13 · updated 2026-10-24
Weakness: CWE-22

Description

A vulnerability in Thales CERT "Suspicious" application =< 1.3.4 allows a remote and unauthenticated attacker to execute arbitrary code and arbitrarily overwrite writable application files—including Python modules, configuration files, cron inputs, and runtime artifacts—leading to a persistent denial of service, the potential compromise of application secrets or integrations, and root-level execution inside the Django application container. This vulnerability has been names "Matryoshka Mail". Thales PSIRT acknowledges and thanks Lucien Doustaly (aka wlayzz) for discovering and reporting this issue.

References

https://github.com/thalesgroup-cert/suspicious/security/advisories/GHSA-x85x-9mrm-wwvp

Get alerted when CVE-2026-13014 or the next vulnerability affects your stack