Is CVE-2026-25741 actively exploited?

No active exploitation of CVE-2026-25741 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-25741 be exploited remotely?

Yes. CVE-2026-25741 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-25741?

CVE-2026-25741 has a CVSS score of 7.1 (HIGH).

HOME VULNERABILITIESCVE-2026-25741

HIGH

CVE-2026-25741

CWE-863Published: February 26, 2026· Updated: Feb 27, 2026

7.1

CVSS v3.1

EPSS:0.04%probability of exploitation in 30 daysPercentile:10.2th

Official Description

Zulip is an open-source team collaboration tool. Prior to commit bf28c82dc9b1f630fa8e9106358771b20a0040f7, the API endpoint for creating a card update session during an upgrade flow was accessible to users with only organization member privileges. When the associated Stripe Checkout session is completed, the Stripe webhook updates the organization’s default payment method. Because no billing-specific authorization check is enforced, a regular (non-billing) member can change the organization’s payment method. This vulnerability affected the Zulip Cloud payment processing system, and has been patched as of commit bf28c82dc9b1f630fa8e9106358771b20a0040f7. Self-hosted deploys are no longer affected and no patch or upgrade is required for them.

NVD Source

Technical Analysis

CVE-2026-25741 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in full integrity compromise (data manipulation), with a CVSS base score of 7.1.