9.9 Critical
CVE-2026-38526
No description published yet
Vendor not yet named
Status
- Not in CISA KEV
Exploit probabilityEPSSchecked 25 Oct
3.8%probability of exploitation in the next 30 days
Higher than 90% of scored CVEs
SeverityCVSS
9.9Critical
Description NVD
An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x allows attackers to execute arbitrary code via uploading a crafted PHP file.
Coverage 1 article · 1 outlet
- CVE-2026-38526: Critical RCE Bug in Krayin CRM TinyMCE UploadSOCRadar · first in our coverage