Vulnerability intelligence
CVE-2026-26956
Official description is being retrieved from NVD — refresh shortly.
CVSS Score
9.8
Critical
EPSS — Exploit Probability
0.0%
Riskier than 0% of all CVEs
Exploitation
Not in CISA KEV
No federal exploitation record
Remediation
unknown
Check vendor advisories
2 articles across 2 outlets · first covered May 7, 2026 · latest May 7, 2026
Coverage timeline
-
CVE-2026-26956: vm2 Sandbox Escape Enables Host RCE in Node.js 25socradar.io · May 7, 2026
-
Critical vm2 Node.js flaws expose systems to sandbox escapesthehackernews.com · May 7, 2026