Is CVE-2026-2552 actively exploited?

A proof-of-concept exploit is publicly available for CVE-2026-2552, but active exploitation has not been confirmed.

Can CVE-2026-2552 be exploited remotely?

Partially. CVE-2026-2552 requires adjacent network access (same network segment) to exploit.

What is the CVSS score of CVE-2026-2552?

CVE-2026-2552 has a CVSS score of 5.5 (MEDIUM) and an EPSS exploitation probability of 0.05%.

HOME VULNERABILITIESCVE-2026-2552

MEDIUMPOC

CVE-2026-2552

CWE-22Published: February 16, 2026· Updated: Feb 20, 2026

5.5

CVSS v3.1

EPSS:0.02%probability of exploitation in 30 daysPercentile:5.7th

Official Description

A vulnerability was identified in ZenTao up to 21.7.8. Affected by this issue is the function delete of the file editor/control.php of the component Committer. Such manipulation of the argument filePath leads to path traversal. Upgrading to version 21.7.9 can resolve this issue. The affected component should be upgraded.

NVD Source

Technical Analysis

CVE-2026-2552 requires adjacent network access, limiting remote exploitation but still posing risk in shared or local network environments.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A proof-of-concept (PoC) exploit exists for CVE-2026-2552. While not yet confirmed in active campaigns, the availability of PoC code increases exploitation risk substantially.