VulnAway
fr de it en

CVE-2026-109618 NVD ↗

9.8
CVSS 3.1
CVSS v3.1 (FIRST): Base score from 0.0 to 10.0 rating the intrinsic severity of a vulnerability (attack vector, complexity, privileges, user interaction, scope, confidentiality / integrity / availability impact).
Displayed: 9.8 — nvd@nist.gov (Primary)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity ratings:
9.0 – 10.0 — Critical
7.0 – 8.9 — High
4.0 – 6.9 — Medium
0.1 – 3.9 — Low
9.2
CVSS 4.0
CVSS v4.0 (FIRST, 2023): Base score from 0.0 to 10.0 rating the intrinsic severity of a vulnerability. Adds Attack Requirements (AT), separates impact on the vulnerable system (VC/VI/VA) from subsequent systems (SC/SI/SA), and supports supplemental metrics.
Displayed: 9.2 — security@php.net (Secondary)
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity ratings:
9.0 – 10.0 — Critical
7.0 – 8.9 — High
4.0 – 6.9 — Medium
0.1 – 3.9 — Low
11.6 %
Current EPSS
EPSS (Exploit Prediction Scoring System, FIRST.org): estimated probability that the CVE will be exploited in the wild within the next 30 days. Recomputed daily. It is a prediction, not a confirmed exploitation (see KEV for that). The percentile gives the rank among all scored CVEs.
≥ 95 % — near-certain exploitation (drawn in red on the chart)
50 – 95 % — high probability of exploit
10 – 50 % — priority patching
1 – 10 % — watch (VulnAway alert threshold is 1 %)
< 1 % — low probability
96.0 %
EPSS percentile
EPSS percentile: rank of this CVE's EPSS score among all CVEs scored by FIRST.org. It is not a probability — the probability is the EPSS score itself. This CVE scores higher than 96.0 % of scored CVEs.
≥ 95 % — top 5 % of scored CVEs (red)
80 – 95 % — top 20 % (orange)
50 – 80 % — above the median (yellow)
< 50 % — below the median (green)
No
KEV
KEV — CISA Known Exploited Vulnerabilities catalog: CVEs for which CISA has evidence of active exploitation in the wild. Listed CVEs carry a due date by which US federal agencies must remediate.
Listed in KEV — CISA has confirmed exploitation
Not listed in KEV
Analyzed
NVD status
NVD vulnerability status (vulnStatus)
Received — NVD has received the CVE from the CVE List; not yet processed.
Awaiting Analysis — Queued for NVD analysis; no NVD CVSS score or product (CPE) data yet.
Undergoing Analysis — NVD analysts are working on it; data may still change.
Analyzed — NVD analysis is complete: NVD CVSS score, weaknesses (CWE) and affected products (CPE) are published.
Modified — Changed after analysis (new data from the CNA or a NVD update).
Deferred — NVD will not analyze it (typically older CVEs or low priority); CNA data only.
Rejected — Withdrawn by the CVE Program (duplicate, invalid or not a vulnerability).
Published by NVD
2026-10-21 14:17:09 UTC
→
Detected by VulnAway
2026-10-21 14:20:03 UTC
=
Detection delay
2 min 54 s

Last NVD change: 2026-10-23 16:26:54 (UTC).

EPSS trend

0 %10 %20 %30 %40 %50 %60 %21.10 14:1722.10 07:4923.10 01:2123.10 18:5424.10 12:2610 % — Priority Patching50 % — High probability of exploit0.0 %5.3 %11.6 %0 % (no EPSS yet) — since 21.10 14:17 — 1 d 13 h5.3 % — since 23.10 03:30 — 1 d11.6 % — since 24.10 03:30 — 8 h 56 min (ongoing)
Date (UTC)EventDetailsCVSS 3.xCVSS 4.xEPSSKEV
2026-10-21 14:20PublicationCVE registered9.89.20.0 %—
2026-10-23 03:30EPSSEPSS 0.0 % → 5.3 %9.89.25.3 %—
2026-10-24 03:30EPSSEPSS 5.3 % → 11.6 % (percentile 96.0 %)9.89.211.6 %—