Is CVE-2026-40175 actively exploited?

A proof-of-concept exploit is publicly available for CVE-2026-40175, but active exploitation has not been confirmed.

Can CVE-2026-40175 be exploited remotely?

Yes. CVE-2026-40175 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-40175?

CVE-2026-40175 has a CVSS score of 4.8 (MEDIUM).

HOME VULNERABILITIESCVE-2026-40175

MEDIUMPOC

CVE-2026-40175

CWE-113Published: April 10, 2026· Updated: Apr 16, 2026

4.8

CVSS v3.1

Official Description

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.3.1, the Axios library is vulnerable to a specific "Gadget" attack chain that allows Prototype Pollution in any third-party dependency to be escalated into Remote Code Execution (RCE) or Full Cloud Compromise (via AWS IMDSv2 bypass). This vulnerability is fixed in 1.15.0 and 0.3.1.

NVD Source

Technical Analysis

CVE-2026-40175 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A proof-of-concept (PoC) exploit exists for CVE-2026-40175. While not yet confirmed in active campaigns, the availability of PoC code increases exploitation risk substantially.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorNetwork

Attack ComplexityHigh

Privileges Req.None

User InteractionNone

ScopeUnchanged

Impact

ConfidentialityLow

IntegrityLow

AvailabilityNone

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Affected Vendors & Products

Mentioned vendors (from description):

Node.js

CPE data not yet available in NVD for this CVE.

Exploit & PoC Resources

POC AVAILABLEProof-of-concept code exists

Exploit-DB

Offensive Security exploit database

GitHub PoC Search

Community PoC repositories

Rapid7 / Metasploit

Metasploit module search

PacketStorm

Security advisories & exploits

External links open in a new tab. Always verify in a controlled environment before use.

News & Research Mentioning CVE-2026-40175

Siemens gWAP

CISA Alerts· May 14, 2026

View CSAF Summary Siemens gPROMS Web Applications Publisher (gWAP) is affected by a remote code execution vulnerability introduced through a third-party component, namely the Axios HTTP client library. The vulnerability stems from a specific "Gadget" attack chain that allows prototype pollution in other third-party libraries, potentially allowing an attacker to execute arbitrary code. Siemens has released a new version for gWAP and recommends to update to the latest version. The following versions of Siemens gWAP are affected: gWAP vers:intdot/<3.1.1 CVSS Vendor Equipment Vulnerabilities v3 8 Siemens Siemens gWAP Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') Background Critical Infrastructure Sectors: C [xlite_meta score:73 src:CISA Alerts xlite_fp:13c2dd4ed0baed4ab9eb7b8e644a675eee59ea7602efc640d10f317258387fda]