Is CVE-2023-26512 actively exploited?

No active exploitation of CVE-2023-26512 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2023-26512 be exploited remotely?

Yes. CVE-2023-26512 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2023-26512?

CVE-2023-26512 has a CVSS score of 9.8 (CRITICAL).

HOME VULNERABILITIESCVE-2023-26512

CRITICAL

CVE-2023-26512

CWE-502Published: July 17, 2023· Updated: Jun 17, 2026

9.8

CVSS v3.1

Official Description

CWE-502 Deserialization of Untrusted Data at the rabbitmq-connector plugin module in Apache EventMesh (incubating) V1.7.0\V1.8.0 on windows\linux\mac os e.g. platforms allows attackers to send controlled message and

remote code execute via rabbitmq messages. Users can use the code under the master branch in project repo to fix this issue, we will release the new version as soon as possible.

NVD Source

Risk Analysis

The rabbitmq-connector module in Apache EventMesh is vulnerable to deserialization of untrusted data. Attackers can send malicious messages to achieve remote code execution on the host system. This is a critical vulnerability with a CVSS score of 9.8.

There is no public exploit circulating for this issue, and it is not in the CISA KEV catalog. The flaw is remotely exploitable.

Recommended Action

Users should apply the fix provided in the project repository and monitor for the official release of a patched version.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2023-26512 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 9.8.

From a weakness classification perspective (CWE-502): Insecure deserialization vulnerabilities allow attackers to inject malicious objects during deserialization, potentially enabling remote code execution.