Is CVE-2026-37526 actively exploited?

No active exploitation of CVE-2026-37526 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-37526 be exploited remotely?

No. CVE-2026-37526 requires local access to exploit.

What is the CVSS score of CVE-2026-37526?

CVE-2026-37526 has a CVSS score of 7.8 (HIGH).

HOME VULNERABILITIESCVE-2026-37526

HIGH

CVE-2026-37526

CWE-284Published: May 1, 2026· Updated: May 7, 2026

7.8

CVSS v3.1

EPSS:0.02%probability of exploitation in 30 daysPercentile:5.4th

Official Description

AGL app-framework-binder (afb-daemon) through v19.90.0 allows any local process to execute privileged supervision commands (Exit, Do, Sclose, Config, Trace, Debug, Token, slist) without authentication via the abstract Unix socket @urn:AGL:afs:supervision:socket. The on_supervision_call function in src/afb-supervision.c dispatches all 8 commands without any credential verification. The abstract socket has no DAC protection, as acknowledged in the official CAUTION comment in src/afs-supervision.h. This allows a low-privileged local process to kill the daemon (DoS via Exit command), execute arbitrary API calls (via Do command), close arbitrary user sessions (via Sclose command), or leak the entire global configuration (via Config command). The vulnerability was introduced in commit b8c9d5de384efcfa53ebdb3f0053d7b3723777e1 on 2017-06-29.

NVD Source

Technical Analysis

CVE-2026-37526 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 7.8.