Is CVE-2026-48962 actively exploited?

No active exploitation of CVE-2026-48962 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-48962 be exploited remotely?

Yes. CVE-2026-48962 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-48962?

CVE-2026-48962 has a CVSS score of 7.3 (HIGH).

HOME VULNERABILITIESCVE-2026-48962

HIGH

CVE-2026-48962

CWE-95Published: May 27, 2026· Updated: May 27, 2026

7.3

CVSS v3.1

Official Description

IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob.

_parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl.

Arbitrary Perl in the output glob executes at the calling process's privilege.

NVD Source

Technical Analysis

CVE-2026-48962 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.