Is CVE-2026-47136 actively exploited?

No active exploitation of CVE-2026-47136 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-47136 be exploited remotely?

Yes. CVE-2026-47136 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-47136?

CVE-2026-47136 has a CVSS score of 6.9 (MEDIUM).

HOME VULNERABILITIESCVE-2026-47136

MEDIUM

CVE-2026-47136

CWE-200Published: May 28, 2026· Updated: May 29, 2026

6.9

CVSS v3.1

EPSS:0.05%probability of exploitation in 30 daysPercentile:15.8th

Official Description

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, the RustFS console endpoint GET /rustfs/console/license returns parsed license metadata without requiring authentication. The endpoint is registered on the console listener and returns JSON containing license information such as the license subject and expiration timestamp. Any client that can reach the console listener can query this endpoint without credentials. This vulnerability is fixed in 1.0.0-beta.2.

NVD Source

Technical Analysis

CVE-2026-47136 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

From a weakness classification perspective (CWE-200): Information exposure vulnerabilities leak sensitive data to unauthorized actors.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorNetwork

Attack ComplexityLow

Privileges Req.None

User InteractionNone

ScopeX

Impact

Confidentiality

Integrity

Availability

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X