Is CVE-2026-25742 actively exploited?

No active exploitation of CVE-2026-25742 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-25742 be exploited remotely?

Yes. CVE-2026-25742 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-25742?

CVE-2026-25742 has a CVSS score of 5.3 (MEDIUM).

HOME VULNERABILITIESCVE-2026-25742

MEDIUM

CVE-2026-25742

CWE-862Published: April 3, 2026· Updated: Apr 8, 2026

5.3

CVSS v3.1

EPSS:0.03%probability of exploitation in 30 daysPercentile:8.4th

Official Description

Zulip is an open-source team collaboration tool. Prior to version 11.6, Zulip is an open-source team collaboration tool. From version 1.4.0 to before version 11.6, even after spectator access (enable_spectator_access / WEB_PUBLIC_STREAMS_ENABLED) is disabled, attachments originating from web-public streams can still be retrieved anonymously. As a result, file contents remain accessible even after public access is intended to be disabled. Similarly, even after spectator access is disabled, the /users/me/<stream_id>/topics endpoint remains reachable anonymously, allowing retrieval of topic history for web-public streams. This issue has been patched in version 11.6. This issue has been patched in version 11.6.

NVD Source

Technical Analysis

CVE-2026-25742 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.