Is CVE-2026-2895 actively exploited?

A proof-of-concept exploit is publicly available for CVE-2026-2895, but active exploitation has not been confirmed.

Can CVE-2026-2895 be exploited remotely?

Yes. CVE-2026-2895 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-2895?

CVE-2026-2895 has a CVSS score of 8.1 (HIGH) and an EPSS exploitation probability of 0.07%.

HOME VULNERABILITIESCVE-2026-2895

HIGHPOC

CVE-2026-2895

CWE-640Published: February 21, 2026· Updated: Feb 24, 2026

8.1

CVSS v3.1

EPSS:0.07%probability of exploitation in 30 daysPercentile:22.3th

Official Description

A security flaw has been discovered in funadmin up to 7.1.0-rc4. Affected by this issue is the function repass of the file app/frontend/controller/Member.php. Performing a manipulation of the argument forget_code/vercode results in weak password recovery. Remote exploitation of the attack is possible. The attack's complexity is rated as high. The exploitation is known to be difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

NVD Source

Technical Analysis

CVE-2026-2895 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 8.1.

A proof-of-concept (PoC) exploit exists for CVE-2026-2895. While not yet confirmed in active campaigns, the availability of PoC code increases exploitation risk substantially.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorNetwork

Attack ComplexityHigh

Privileges Req.None

User InteractionNone

ScopeUnchanged

Impact

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Vendors & Products

funadmin1 product

funadmin

Source: NVD CPE · 2 total CPE entries

Exploit & PoC Resources

POC AVAILABLEProof-of-concept code exists

Exploit-DB

Offensive Security exploit database

GitHub PoC Search

Community PoC repositories

Rapid7 / Metasploit

Metasploit module search

PacketStorm

Security advisories & exploits

External links open in a new tab. Always verify in a controlled environment before use.

Official Patches & Advisories

ADVISORYhttps://vuldb.com/?id.347206

ADVISORYhttps://vuldb.com/?submit.753971

News & Research Mentioning CVE-2026-2895

Apple Patches Exploited Notification Flaw, (Thu, Apr 23rd)

SANS ISC· Apr 23, 2026

Apple yesterday released iOS/iPadOS 26.4.2 and iOS/iPadOS 18.7.8. This update fixes a single Notification Services vulnerability, CVE-2026-28950: [xlite_meta score:54 src:SANS ISC xlite_fp:29c8d20972163f619faefd69a515b63fd63b4476013540e9f204fd6562b24b53]

Apple Fixes iOS Flaw That Let FBI Recover Deleted Signal Messages

The Hacker News· Apr 23, 2026

Apple has rolled out a software fix for iOS and iPadOS to address a Notification Services flaw that stored notifications marked for deletion on the device. The vulnerability, tracked as CVE-2026-28950 (CVSS score: N/A), has been described as a logging issue that has been addressed with improved data redaction. "Notifications marked for deletion could be unexpectedly retained on the device," [xlite_meta score:50 src:The Hacker News xlite_fp:23509408678e706c0eb3e72512bb513ec10888ac0bab57427ddbdee55a02ba69]