Is CVE-2026-4476 actively exploited?

No active exploitation of CVE-2026-4476 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-4476 be exploited remotely?

Partially. CVE-2026-4476 requires adjacent network access (same network segment) to exploit.

What is the CVSS score of CVE-2026-4476?

CVE-2026-4476 has a CVSS score of 6.3 (MEDIUM).

HOME VULNERABILITIESCVE-2026-4476

MEDIUM

CVE-2026-4476

CWE-287Published: March 20, 2026· Updated: Mar 20, 2026

6.3

CVSS v3.1

EPSS:0.01%probability of exploitation in 30 daysPercentile:0.8th

Official Description

A vulnerability was found in Yi Technology YI Home Camera 2 2.1.1_20171024151200. The impacted element is an unknown function of the file home/web/ipc of the component CGI Endpoint. Performing a manipulation results in missing authentication. Access to the local network is required for this attack. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

NVD Source

Technical Analysis

CVE-2026-4476 requires adjacent network access, limiting remote exploitation but still posing risk in shared or local network environments.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

From a weakness classification perspective (CWE-287): Authentication bypass vulnerabilities allow attackers to access protected resources without valid credentials.