Is CVE-2026-11576 actively exploited?

No active exploitation of CVE-2026-11576 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-11576 be exploited remotely?

Yes. CVE-2026-11576 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-11576?

CVE-2026-11576 has a CVSS score of 7.5 (HIGH).

HOME VULNERABILITIESCVE-2026-11576

HIGH

CVE-2026-11576

CWE-415Published: June 19, 2026· Updated: Jun 22, 2026

7.5

CVSS v3.1

Official Description

The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT process to use a shared cleanup label, but this unified cleanup path unconditionally calls fx_file_close() even when the file was never successfully opened. Multiple error branches jump to the shared cleanup label before any file open operation has occurred, causing fx_file_close() to operate on an uninitialized file handle, leading to undefined behavior, double-close issues, or memory corruption.

NVD Source

Technical Analysis

CVE-2026-11576 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in availability disruption (denial of service), with a CVSS base score of 7.5.