CVE-2026-94003Disclosure

LOWCVSS 9.3 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

A vulnerability has been found in Comfast CF-N1-S 2.6.0.1. Impacted is the function get_css_path_from_uri of the file /cgi-bin/mbox-config of the component Web Management Interface. The manipulation leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

1.5/ 10 priority

Sources & remediation

Weakness type (CWE)
CWE-119CWE-121

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

RISING

Threat summary

  • Public PoC is present in monitored signal
  • 8 mentions across 5 observed days
  • Momentum state: rising

What's happening

  • PoC mentioned or linked in 1 signal
  • Technical details provided in 6 signals
  • Disclosure: 5 classified signals
  • General: 2 classified signals
  • Peaked 2d ago at 4 mentions (2026-09-21); latest day: 1
  • 8 total mentions across 5 days

Deep dive

Activity timeline8 mentions / 5d
01234Mentions · 2026-09-19: 1Mentions · 2026-09-20: 1Mentions · 2026-09-21: 4Mentions · 2026-09-22: 1Mentions · 2026-10-31: 1PoC Mentioned / Linked · 2026-09-21: 1Technical Details · 2026-09-20: 1Technical Details · 2026-09-21: 3Technical Details · 2026-09-22: 1Technical Details · 2026-10-31: 109-1909-2009-2109-2210-31
Signal classification3 categories
Disclosure
562.5%
General
225.0%
PoC
112.5%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-09-191
Disclosure1
2026-09-201
General1
2026-09-214
Disclosure2General1PoC1
2026-09-221
Disclosure1
2026-10-311
Disclosure1
Full discourse8 posts
  • ExploitGrid@exploitgrid
    General

    🛡️ #ExploitGrid Daily #Threat Digest Top Vulnerabilities (CVEs) of the day CVE-2026-88854 - EXPLOIT CVE-2026-94036 - EXPLOIT CVE-2026-94003 CVE-2026-94089 CVE-2026-94097 ..🧵👇

    Post summary

    The tweet is a daily threat digest that enumerates several CVEs, with two marked as "EXPLOIT," but it provides no PoC, exploit code, patches, or evidence of active exploitation.

    1102097
    403 followersView on X
  • Hugo | DevOps | Cybersecurity@HugoValters
    Disclosure

    CVE-2026-94003: stack buffer overflow in Comfast CF-N1-S web interface, remote, public exploit, CVSS 10, unpatched. Restrict access now. #CVE #infosec #cybersecurity https://www.valtersit.com/cve/CVE-2026-94003/ #Comfast #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker

    Post summary

    The tweet discloses a newly identified stack buffer overflow (CVE‑2026‑94003) in the Comfast CF‑N1‑S web interface, reporting a remote CVSS‑10 severity, a public exploit, and urging network restriction pending a fix.

    0000167
    1.0K followersView on X
  • ExploitGrid@exploitgrid
    Disclosure

    🟠 HIGH PRIORITY ├ CVE-2026-94003 — Comfast CF-N1-S · Stack overflow ├ CVE-2026-94089 — D-Link DIR-868L · strcpy stack smash └ CVE-2026-94097 — Netcore NBR200V2 · Command injection

    Post summary

    The text serves as a disclosure, announcing three newly identified CVEs with short technical descriptions and marking them as high priority, but provides no information on PoC, exploit tools, active exploitation, or patches.

    1000026
    202 followersView on X
  • ExploitGrid@exploitgrid
    Disclosure

    🟠 HIGH PRIORITY CVE-2026-94003: Comfast CF-N1-S · Stack overflow CVE-2026-94089: D-Link DIR-868L · strcpy stack smash CVE-2026-94097: Netcore NBR200V2 · Command injection

    Post summary

    The text lists three high-priority CVEs with specific vulnerability types for affected devices. It is primarily a disclosure of vulnerabilities without PoC, exploit, patch, or active-exploitation details.

    1000050
    155 followersView on X
  • ExploitGrid@exploitgrid
    PoC

    [CVE] CVE-2026-94003 [HIGH PRIORITY] #Comfast CF-N1-S Web Management mbox-config get_css_path_from_uri stack-based ... 🔗 https://exploitgrid.net/cve/CVE-2026-94003

    Post summary

    The text announces CVE-2026-94003, a high-priority stack-based vulnerability in Comfast devices, and links to a PoC or exploit details. Technical details are provided, but no named exploit tool, patch, or active exploitation claims are explicitly mentioned.

    1000036
    155 followersView on X
  • ADK Cyber@ADKCyber
    Disclosure

    Critical CVSS 10.0 flaw in Comfast CF-N1-S 2.6.0.1 web management interface. Review devices and apply updates if in use: https://nvd.nist.gov/vuln/detail/CVE-2026-94003 via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability #AI #MachineLearning https://t.co/sUbNVWVWfk

    Post summary

    The tweet discloses a critical CVSS 10.0 vulnerability in Comfast CF-N1-S 2.6.0.1, urging users to review and update their devices. Technical details (CVSS score) confirm it as a high-severity flaw announcement.

    0000040
    96 followersView on X
  • 𝔸𝕟𝕠𝕟𝕪𝕞𝕠𝕦𝕤 ℍ𝕒𝕔𝕜𝕥𝕚𝕧𝕚𝕤𝕥☭⃠🅇@YourAnon_irc
    General

    Recent critical CVEs (e.g., CVE-2026-94003, CVSS 10.0 updated Sep 20, 2026) threaten network security & secure protocols. Exploitation risks severe data privacy breaches & integrity compromise in transit. #Cybersecurity #Vulnerabilities #News

    Post summary

    The text highlights critical CVEs with technical details (CVE ID, CVSS score) and general exploitation risks but lacks specific indicators such as PoC, exploit tools, active exploitation claims, or named patches.

    0000031
    16 followersView on X
  • VulDB 🛡@vuldb
    Disclosure

    A new vulnerability with increased severity was disclosed for Comfast CF-N1-S (CVE-2026-94003) https://vuldb.com/vuln/407952

    Post summary

    The tweet reports a newly disclosed vulnerability (CVE‑2026‑94003) for the Comfast CF‑N1‑S device, highlighting its increased severity, and provides a link to a VulDB page for more information.

    00000127
    2.3K followersView on X

Explore more