Is CVE-2026-7263 actively exploited?

No active exploitation of CVE-2026-7263 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-7263 be exploited remotely?

Yes. CVE-2026-7263 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-7263?

CVE-2026-7263 has a CVSS score of 7.5 (HIGH).

HOME VULNERABILITIESCVE-2026-7263

HIGH

CVE-2026-7263

CWE-404Published: May 10, 2026· Updated: May 12, 2026

7.5

CVSS v3.1

EPSS:0.04%probability of exploitation in 30 daysPercentile:12.8th

Official Description

In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N() method may process the XML data incorrectly, causing a circular linked list in the data structure representing the XML document. This may cause subsequent processing of the XML document to enter infinite loop, causing denial of service in the processing application.

NVD Source

Technical Analysis

CVE-2026-7263 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in availability disruption (denial of service), with a CVSS base score of 7.5.