Is CVE-2026-44633 actively exploited?

No active exploitation of CVE-2026-44633 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-44633 be exploited remotely?

Yes. CVE-2026-44633 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-44633?

CVE-2026-44633 has a CVSS score of 8.1 (HIGH).

HOME VULNERABILITIESCVE-2026-44633

HIGH

CVE-2026-44633

CWE-863Published: May 14, 2026· Updated: May 15, 2026

8.1

CVSS v3.1

EPSS:0.03%probability of exploitation in 30 daysPercentile:8.2th

Official Description

Live Helper Chat is an open-source application that enables live support websites. In 4.84v, the Live Helper Chat REST API chat update endpoint allows a REST user with lhchat/use to update a chat in a department they cannot read. The endpoint accepts arbitrary chat object fields, so the user can change the chat hash and status and then access or tamper with the chat through visitor/widget paths. The same write primitive can set operation_admin, which is later emitted as operator-side JavaScript.

NVD Source

Technical Analysis

CVE-2026-44633 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), with a CVSS base score of 8.1.