Is CVE-2026-45087 actively exploited?

No active exploitation of CVE-2026-45087 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-45087 be exploited remotely?

Yes. CVE-2026-45087 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-45087?

CVE-2026-45087 has a CVSS score of 10.0 (CRITICAL).

HOME VULNERABILITIESCVE-2026-45087

CRITICAL

CVE-2026-45087

CWE-15Published: May 27, 2026· Updated: May 28, 2026

10.0

CVSS v3.1

EPSS:0.05%probability of exploitation in 30 daysPercentile:14.6th

Official Description

Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is started in REST API server mode (dalfox server), the server binds to 0.0.0.0:6664 by default and requires no API key unless the operator explicitly passes --api-key. Because model.Options — including FoundAction and FoundActionShell — is deserialized directly from attacker-supplied JSON in POST /scan, and because dalfox.Initialize explicitly propagates those two fields into the final scan options without stripping them, any unauthenticated caller who can reach the server port can supply an arbitrary shell command that the dalfox process will execute on the host whenever a scan finding is triggered. This vulnerability is fixed in 2.13.0.

NVD Source

Risk Analysis

This critical vulnerability in Dalfox, when running in REST API server mode, allows an unauthenticated attacker to achieve remote code execution. By sending a crafted JSON payload to the /scan endpoint, an attacker can inject arbitrary shell commands that will execute on the host when a scan finding is triggered. The CVSS score of 10.0 indicates the highest possible severity.

There are currently no public exploits known for this vulnerability. The flaw is remotely exploitable with low attack complexity, meaning an attacker could potentially exploit it over a network without significant effort.

Recommended Action

Upgrade Dalfox to version 2.13.0 or later to remediate this remote code execution vulnerability. When running Dalfox in server mode, always configure an API key and ensure the server is not exposed to untrusted networks.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2026-45087 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 10.0.

The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.