Is CVE-2026-33386 actively exploited?

No active exploitation of CVE-2026-33386 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-33386 be exploited remotely?

Partially. CVE-2026-33386 requires adjacent network access (same network segment) to exploit.

What is the CVSS score of CVE-2026-33386?

CVE-2026-33386 has a CVSS score of 2.3 (LOW).

HOME VULNERABILITIESCVE-2026-33386

LOW

CVE-2026-33386

CWE-79Published: May 29, 2026· Updated: May 29, 2026

2.3

CVSS v3.1

EPSS:0.03%probability of exploitation in 30 daysPercentile:7.7th

Official Description

QuickCMS is vulnerable to Cross-Site Scripting (XSS) through its insecure HTTP-based plugin‑fetching mechanism. A malicious attacker can perform a Man‑in‑the‑Middle (MITM) attack by impersonating the opensolution.org server and serving arbitrary HTML or JavaScript at the plugin list endpoint. When a user accesses the plugin page, the malicious content is automatically fetched, rendered, and executed.

This issue was fixed in a patch to version 6.8 published on 15.05.2026, deployments without this patch are still vulnerable.

NVD Source

Technical Analysis

CVE-2026-33386 requires adjacent network access, limiting remote exploitation but still posing risk in shared or local network environments.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

From a weakness classification perspective (CWE-79): Cross-site scripting (XSS) vulnerabilities allow attackers to inject malicious scripts into web pages viewed by other users.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorAdjacent

Attack ComplexityLow

Privileges Req.None

User InteractionNone

ScopeX

Impact

Confidentiality

Integrity

Availability

CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X