Is CVE-2026-27480 actively exploited?

A proof-of-concept exploit is publicly available for CVE-2026-27480, but active exploitation has not been confirmed.

Can CVE-2026-27480 be exploited remotely?

Yes. CVE-2026-27480 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-27480?

CVE-2026-27480 has a CVSS score of 5.3 (MEDIUM) and an EPSS exploitation probability of 0.01%.

HOME VULNERABILITIESCVE-2026-27480

MEDIUMPOC

CVE-2026-27480

CWE-204Published: February 21, 2026· Updated: Feb 24, 2026

5.3

CVSS v3.1

EPSS:0.01%probability of exploitation in 30 daysPercentile:1.8th

Official Description

Static Web Server (SWS) is a production-ready web server suitable for static web files or assets. In versions 2.1.0 through 2.40.1, a timing-based username enumeration vulnerability in Basic Authentication allows attackers to identify valid users by exploiting early responses for invalid usernames, enabling targeted brute-force or credential-stuffing attacks. SWS checks whether a username exists before verifying the password, causing valid usernames to follow a slower code path (e.g., bcrypt hashing) while invalid usernames receive an immediate 401 response. This timing discrepancy allows attackers to enumerate valid accounts by measuring response-time differences. This issue has been fixed in version 2.41.0.

NVD Source

Technical Analysis

CVE-2026-27480 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A proof-of-concept (PoC) exploit exists for CVE-2026-27480. While not yet confirmed in active campaigns, the availability of PoC code increases exploitation risk substantially.