Is CVE-2026-31999 actively exploited?

No active exploitation of CVE-2026-31999 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-31999 be exploited remotely?

No. CVE-2026-31999 requires local access to exploit.

What is the CVSS score of CVE-2026-31999?

CVE-2026-31999 has a CVSS score of 7.8 (HIGH).

HOME VULNERABILITIESCVE-2026-31999

HIGH

CVE-2026-31999

CWE-78Published: March 19, 2026· Updated: Mar 19, 2026

7.8

CVSS v3.1

EPSS:0.06%probability of exploitation in 30 daysPercentile:19.0th

Official Description

OpenClaw versions 2026.2.26 prior to 2026.3.1 on Windows contain a current working directory injection vulnerability in wrapper resolution for .cmd/.bat files that allows attackers to influence execution behavior through cwd manipulation. Remote attackers can exploit improper shell execution fallback mechanisms to achieve command execution integrity loss by controlling the current working directory during wrapper resolution.

NVD Source

Technical Analysis

CVE-2026-31999 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 7.8.