Is CVE-2026-7722 actively exploited?

No active exploitation of CVE-2026-7722 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-7722 be exploited remotely?

Yes. CVE-2026-7722 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-7722?

CVE-2026-7722 has a CVSS score of 5.3 (MEDIUM).

HOME VULNERABILITIESCVE-2026-7722

MEDIUM

CVE-2026-7722

CWE-287Published: May 4, 2026· Updated: May 4, 2026

5.3

CVSS v3.1

EPSS:0.07%probability of exploitation in 30 daysPercentile:21.9th

Official Description

A vulnerability was detected in PrefectHQ prefect up to 3.6.21. This impacts the function endswith of the file /api/health of the component Health Check API. Performing a manipulation results in improper authentication. The attack is possible to be carried out remotely. The exploit is now public and may be used. Upgrading to version 3.6.22 will fix this issue. The patch is named e21617125335025b4b27e7d6f0ca028e8e8f3b79. Upgrading the affected component is recommended. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

NVD Source

Technical Analysis

CVE-2026-7722 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

From a weakness classification perspective (CWE-287): Authentication bypass vulnerabilities allow attackers to access protected resources without valid credentials.