What is CVE-2026-92718?

CVE-2026-92718 is a high-severity vulnerability in Projectdiscovery Nuclei, classified under Improper Verification of Cryptographic Signature. CVSS score: 7.3/10. Published 2026-09-16.

How severe is CVE-2026-92718?

High severity. CVSS v3 base score is 7.3 out of 10.

Vulnerability in Projectdiscovery Nuclei

CVE-2026-92718

Nuclei versions before 3.11.1 cache template signature verification based only on file modification time without content checksums. Attackers can replace verified templates with unsigned malicious content and restore the original modification time to bypass signature checks and execute arbitrary operating system commands.

CVSS v3 metric

CVSS v3 base score 7.3 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H.

Affected products

Projectdiscovery Nuclei

Weakness classification (CWE)

CWE-347 — Improper Verification of Cryptographic Signature

References

disclosure@vulncheck.com (issue-tracking)
disclosure@vulncheck.com (product)
disclosure@vulncheck.com (technical-description)
disclosure@vulncheck.com (technical-description)
disclosure@vulncheck.com (patch)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-92718?: CVE-2026-92718 is a high-severity vulnerability in Projectdiscovery Nuclei, classified under Improper Verification of Cryptographic Signature. CVSS score: 7.3/10. Published 2026-09-16.
How severe is CVE-2026-92718?: High severity. CVSS v3 base score is 7.3 out of 10.