CVE-2026-26718

Vexday Risk Score

20Low

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Proof of concept

Public proof of concept exists, but not yet automated.

CVSS —EPSS —KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

14 Jul 2026Public PoC

15 Jul 2026Published on NVD

Weaponization speed

same dayto first PoC

Weaponized quickly — attackers prioritized this vulnerability. Patch urgently.

Recommendation: Plan a near-term fix — a public PoC already exists.

A Cross-Site Request Forgery (CSRF) vulnerability exists in the xxl-job-admin web application v.3.0.0 that allows an attacker to perform unauthorized modifications to Glue IDE shell scripts. The affected endpoint lacks proper CSRF token validation and accepts arbitrary HTTP methods via a permissive request mapping

Affected products

n/a · n/a

public PoCs found — 1

githubgithub.com/Ibrahim-Sartawi/CVE-2026-26718★ 0

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

https://github.com/Ibrahim-Sartawi/CVE-2026-26718 https://xxl-job-admin.com