Is CVE-2026-33869 actively exploited?

No active exploitation of CVE-2026-33869 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-33869 be exploited remotely?

Yes. CVE-2026-33869 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-33869?

CVE-2026-33869 has a CVSS score of 4.8 (MEDIUM).

HOME VULNERABILITIESCVE-2026-33869

MEDIUM

CVE-2026-33869

CWE-863Published: March 27, 2026· Updated: Mar 30, 2026

4.8

CVSS v3.1

EPSS:0.04%probability of exploitation in 30 daysPercentile:12.1th

Official Description

Mastodon is a free, open-source social network server based on ActivityPub. In versions on the 4.5.x branch prior to 4.5.8 and on the 4.4.x branch prior to 4.4.15, an attacker that knows of a quote before it has reached a server can prevent it from being correctly processed on that server. The vulnerability has been patched in Mastodon 4.5.8 and 4.4.15. Mastodon 4.3 and earlier are not affected because they do not support quotes.

NVD Source

Technical Analysis

CVE-2026-33869 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.