CVE-2026-44092: An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it fetches from MQTT. This may lead to integr
An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it fetches from MQTT. This may lead to integrity and availability loss.
Details
Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-44092
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-440920.38% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 31% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-44092 | coverage & exploitation status | NVD · CVE.org |
Recent advisories for An unauthenticated remote
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- criticalCVE-2026-68771: ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset no…nvd · 2026-07-31
- lowCVE-2026-25552: Ghost CLI before 1.30.1 contains an IP spoofing vulnerability that allows unauthenticated remo…nvd · 2026-07-31
- unknownCVE-2026-18140 - Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated re…aws · 2026-07-31
- highCVE-2026-18141: A flaw was found in aap-gateway, a component of Ansible Automation Platform's Event-Driven Ans…nvd · 2026-07-31
- highCVE-2026-11770: A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP s…nvd · 2026-07-31
- criticalCVE-2026-18452: DMS+ (Non-Mobile) developed by Rich Source has a Use of Hard-coded Credentials vulnerability. …nvd · 2026-07-31
More from NVD Recent CVEs
- mediumCVE-2026-18573: A flaw was found in the keycloak-services component of Keycloak, which is used for managing au…2026-08-02
- mediumCVE-2026-18572: Keycloak provides authorization services that allow administrators to restrict access to resou…2026-08-02
- mediumCVE-2026-18571: A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permission…2026-08-02
- mediumCVE-2026-18570: A flaw was found in the full-scope-disabled client-policy executor within the keycloak-service…2026-08-02
- unknownCVE-2026-16540: The Simply Schedule Appointments WordPress plugin before 1.6.12.6 does not correctly restrict …2026-08-02