securitytabs

CVE-2026-44415

High8.9

Affected systems do not properly restrict access to internal APIs and paths for authenticated users. This could allow an authenticated remote attacker to access sensitive internal information, which in the worst case could be leveraged to facilitate unauthorized access to the system or result in the deletion of data.

CVSS
8.9v4.0
EPSS (exploit probability)
0.5%39th pct
CISA KEV
Not listed

EPSS trendFIRST daily scores, last 90 days

FIRST EPSS held steady from 0.5% on 2026-10-14 to 0.5% on 2026-10-22, ranging 0.5%–0.5% across 9 daily scores.
2026-10-14 → 2026-10-22 · 9 days · 0.5%–0.5%
Daily values
FIRST EPSS daily scores for this CVE
Score dateEPSSPercentile
2026-10-220.5%39.0%
2026-10-210.5%39.0%
2026-10-200.5%38.7%
2026-10-190.5%38.7%
2026-10-180.5%38.6%
2026-10-170.5%38.6%
2026-10-160.5%38.6%
2026-10-150.5%38.5%
2026-10-140.5%38.4%

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Coverage2 articles

References

Facts sourced from NVD, FIRST EPSS, and CISA KEV. Last synced 2026-10-22 20:34 UTC.

  • CVSS & description: NVD 2.0, fetched 2026-10-22 19:34 UTC
  • EPSS: FIRST EPSS, fetched 2026-10-22 20:34 UTC; score date 2026-10-22
  • KEV: CISA KEV, fetched 2026-10-22 20:34 UTC