Is CVE-2018-15728 actively exploited?

No active exploitation of CVE-2018-15728 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2018-15728 be exploited remotely?

Yes. CVE-2018-15728 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2018-15728?

CVE-2018-15728 has a CVSS score of 8.8 (HIGH).

HOME VULNERABILITIESCVE-2018-15728

HIGH

CVE-2018-15728

CWE-94Published: August 24, 2018· Updated: Jun 17, 2026

8.8

CVSS v3.1

Official Description

Couchbase Server exposed the '/diag/eval' endpoint which by default is available on TCP/8091 and/or TCP/18091. Authenticated users that have 'Full Admin' role assigned could send arbitrary Erlang code to the 'diag/eval' endpoint of the API and the code would subsequently be executed in the underlying operating system with privileges of the user which was used to start Couchbase. Affects Version: 4.0.0, 4.1.2, 4.5.1, 5.0.0, 4.6.5, 5.0.1, 5.1.1, 5.5.0, 5.5.1. Fix Version: 6.0.0, 5.5.2

NVD Source

Technical Analysis

CVE-2018-15728 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 8.8.