SEPTEMBER 9, 2026
Live Feed
Back to database
Case File

CVE-2026-30618

CRITICAL · CVSS 9.8 EPSS 1.67% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-07-15 · Last synced 2026-08-14

CyberRota Analysis

AI-Generated

The MCP STDIO server management in xszyou Fay 4.3.1 is vulnerable to remote code execution due to improper handling of command execution. A remote attacker can exploit this flaw by accessing the exposed management interface, leading to the execution of arbitrary commands on the server. Organizations using this software should prioritize patching to mitigate the risk of unauthorized access and potential system compromise.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Detected Signals
exploit remote code execution code execution
GitHub PoC Links

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-30618
Severity
CRITICAL
CVSS
9.8
EPSS
1.67%

Original NVD Description

xszyou Fay 4.3.1 contains a remote code execution vulnerability in its MCP STDIO server management and command execution handling. A remote attacker can access the publicly exposed MCP management interface and configure an MCP STDIO server with attacker-controlled commands and parameters, resulting in execution of arbitrary commands on the server. Successful exploitation allows arbitrary command execution within the context of the Fay service.