CVE-2026-26718

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-15 · updated 2026-07-16
Weakness: CWE-352

Description

A Cross-Site Request Forgery (CSRF) vulnerability exists in the xxl-job-admin web application v.3.0.0 that allows an attacker to perform unauthorized modifications to Glue IDE shell scripts. The affected endpoint lacks proper CSRF token validation and accepts arbitrary HTTP methods via a permissive request mapping

References

https://github.com/Ibrahim-Sartawi/CVE-2026-26718
https://xxl-job-admin.com
https://github.com/Ibrahim-Sartawi/CVE-2026-26718

Get alerted when CVE-2026-26718 or the next vulnerability affects your stack