Is CVE-2026-33177 actively exploited?

No active exploitation of CVE-2026-33177 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-33177 be exploited remotely?

Yes. CVE-2026-33177 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-33177?

CVE-2026-33177 has a CVSS score of 4.3 (MEDIUM).

HOME VULNERABILITIESCVE-2026-33177

MEDIUM

CVE-2026-33177

CWE-862Published: March 20, 2026· Updated: Mar 23, 2026

4.3

CVSS v3.1

EPSS:0.01%probability of exploitation in 30 daysPercentile:0.9th

Official Description

Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.14 and 6.7.0, low-privileged Control Panel users could create taxonomy terms by submitting requests to the field action processing endpoint with attacker-controlled field definitions. This bypasses the authorization checks enforced on the standard taxonomy term creation endpoint. This has been fixed in 5.73.14 and 6.7.0.

NVD Source

Technical Analysis

CVE-2026-33177 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.