Is CVE-2026-36356 actively exploited?

Yes. CVE-2026-36356 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2026-36356 be exploited remotely?

Yes. CVE-2026-36356 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-36356?

CVE-2026-36356 has a CVSS score of 9.1 (CRITICAL).

HOME VULNERABILITIESCVE-2026-36356

CRITICALCISA KEVIN THE WILD

CVE-2026-36356

Published: May 5, 2026· Updated: May 7, 2026

9.1

CVSS v3.1

EPSS:0.44%probability of exploitation in 30 daysPercentile:63.0th

Official Description

The GoAhead web server on MeiG Smart FORGE_SLT711 devices (firmware MDM9607.LE.1.0-00110-STD.PROD-1) allows unauthenticated OS command injection via the /action/SetRemoteAccessCfg endpoint.

NVD Source

Risk Analysis

This critical vulnerability in the GoAhead web server on MeiG Smart FORGE_SLT711 devices allows unauthenticated attackers to execute arbitrary operating system commands. With a CVSS score of 9.1, it poses a severe risk of compromise. Its inclusion in CISA's KEV catalog indicates confirmed exploitation.

This vulnerability is actively exploited in the wild and is listed in CISA's KEV catalog. It is remotely exploitable without authentication and has low attack complexity.

Recommended Action

Apply firmware updates for MeiG Smart FORGE_SLT711 devices to a version that addresses this vulnerability. Restrict network access to the GoAhead web server to only necessary and trusted sources.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2026-36356 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), with a CVSS base score of 9.1.

CISA has added CVE-2026-36356 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.