Is CVE-2026-7368 actively exploited?

No active exploitation of CVE-2026-7368 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-7368 be exploited remotely?

Yes. CVE-2026-7368 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-7368?

CVE-2026-7368 has a CVSS score of 8.1 (HIGH).

HOME VULNERABILITIESCVE-2026-7368

HIGH

CVE-2026-7368

CWE-862Published: June 12, 2026· Updated: Jun 17, 2026

8.1

CVSS v3.1

EPSS:0.38%probability of exploitation in 30 daysPercentile:29.1th

Official Description

The Yarbo cloud does not enforce per-device or per-user authorization. Any client possessing valid credentials, whether the shared hard-coded credentials or legitimate per-user credentials, can subscribe to wildcard topics covering all robots globally, and can publish to any robot's command topic using only the robot's serial number (disclosed in the telemetry stream). Even after removal of hard-coded credentials from the app, a single compromised credential could still provide fleet-wide access without per-device access controls.

NVD Source

Technical Analysis

CVE-2026-7368 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), with a CVSS base score of 8.1.