Is CVE-2026-40035 actively exploited?

No active exploitation of CVE-2026-40035 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-40035 be exploited remotely?

Yes. CVE-2026-40035 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-40035?

CVE-2026-40035 has a CVSS score of 9.1 (CRITICAL).

HOME VULNERABILITIESCVE-2026-40035

CRITICAL

CVE-2026-40035

CWE-489Published: April 8, 2026· Updated: Apr 13, 2026

9.1

CVSS v3.1

EPSS:0.10%probability of exploitation in 30 daysPercentile:27.7th

Official Description

Unfurl through 2025.08 contains an improper input validation vulnerability in config parsing that enables Flask debug mode by default. The debug configuration value is read as a string and passed directly to app.run(), causing any non-empty string to evaluate truthy, allowing attackers to access the Werkzeug debugger and disclose sensitive information or achieve remote code execution.

NVD Source

Risk Analysis

This critical vulnerability in Unfurl through 2025.08 stems from improper input validation in config parsing, which can enable Flask debug mode by default. This allows attackers to access the Werkzeug debugger, potentially leading to sensitive information disclosure or remote code execution. The CVSS score of 9.1 highlights the severe impact on confidentiality and integrity.

No public exploit is currently known for this vulnerability. The flaw is remotely exploitable without authentication.

Recommended Action

Users of Unfurl should update to a version beyond 2025.08 to address this improper input validation. Ensure that Flask debug mode is explicitly disabled in production environments.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2026-40035 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), with a CVSS base score of 9.1.