[UPDATE] [high] NATS Server: Multiple vulnerabilities

highCVE-2026-58207 CVE-2026-58208 CVE-2026-58209 CVE-2026-58210 CVE-2026-58211 CVE-2026-58213

An attacker can exploit multiple vulnerabilities in NATS Server to execute arbitrary code, gain elevated permissions, bypass security measures, manipulate or disclose data, or cause a Denial-of-Service condition.

CSIRTS triage

vendor: NATS product: NATS Server Remote code execution Privilege escalation Authentication bypass Information disclosure Denial of service

What: Multiple vulnerabilities allow an attacker to execute arbitrary code, gain elevated permissions, bypass security measures, manipulate or disclose data, or cause a Denial-of-Service condition.
Who is affected: All deployments of NATS Server are at risk.
Urgency: High urgency for remediation due to the severity and potential for exploitation.
Action: Patch NATS Server to the latest version to mitigate these vulnerabilities.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch NATS Server

Get an email when a new NATS Server advisory drops — max one per day, one-click unsubscribe.

Details

Source: CERT-Bund (BSI) Security Advisories (DE · national-cert · site)
Severity: high
Published: 2026-07-09
Exploitation: Not in CISA KEV at last sync
Language: Machine-translated to English — verify against the original

Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2132

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-582070.56% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 43% of all scored CVEs.
Low exploitation riskCVE-2026-582080.59% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 44% of all scored CVEs.
Low exploitation riskCVE-2026-582090.34% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 26% of all scored CVEs.
Low exploitation riskCVE-2026-582100.73% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 50% of all scored CVEs.
Low exploitation riskCVE-2026-582110.29% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 21% of all scored CVEs.
Low exploitation riskCVE-2026-582130.44% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 35% of all scored CVEs.
Low exploitation riskCVE-2026-582140.37% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 29% of all scored CVEs.
Low exploitation riskCVE-2026-582500.73% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 50% of all scored CVEs.
Low exploitation riskCVE-2026-582510.49% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 39% of all scored CVEs.
Low exploitation riskCVE-2026-582520.46% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 37% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-58207	coverage & exploitation status	NVD · CVE.org
CVE-2026-58208	coverage & exploitation status	NVD · CVE.org
CVE-2026-58209	coverage & exploitation status	NVD · CVE.org
CVE-2026-58210	coverage & exploitation status	NVD · CVE.org
CVE-2026-58211	coverage & exploitation status	NVD · CVE.org
CVE-2026-58213	coverage & exploitation status	NVD · CVE.org
CVE-2026-58214	coverage & exploitation status	NVD · CVE.org
CVE-2026-58250	coverage & exploitation status	NVD · CVE.org
CVE-2026-58251	coverage & exploitation status	NVD · CVE.org
CVE-2026-58252	coverage & exploitation status	NVD · CVE.org
CVE-2026-58253	coverage & exploitation status	NVD · CVE.org
CVE-2026-58254	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

Recent advisories for NATS Server

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

mediumCVE-2026-58211: NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging syst…nvd · 2026-07-08
mediumCVE-2026-58208: NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging syst…nvd · 2026-07-08
highCVE-2026-58207: NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging syst…nvd · 2026-07-08
unknownCVE-2026-58254: NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging syst…nvd · 2026-07-08
highCVE-2026-58253: NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging syst…nvd · 2026-07-08
mediumCVE-2026-58252: NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging syst…nvd · 2026-07-08