How severe is CVE-2026-25724?

CVE-2026-25724 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.

Is CVE-2026-25724 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (30th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-25724?

CVE-2026-25724 affects Anthropic Claude Code. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-25724?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

Does CVE-2026-25724 have an EU (EUVD) identifier?

Yes. CVE-2026-25724 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-5614.

When was CVE-2026-25724 published?

CVE-2026-25724 was published on 2026-02-06 and last updated on 2026-06-17.

CVE-2026-25724

CVE-2026-25724 is a high-severity vulnerability in Anthropic Claude Code with a CVSS 3.x base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-61.

Key facts

Severity: High (CVSS 3.x base score 7.5)
CVSS v4: 2.3
EPSS exploit prediction: 0% (30th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-5614
Weakness: CWE-61
Affected product: Anthropic Claude Code
Published: 2026-02-06
Last modified: 2026-06-17

Description

Claude Code is an agentic coding tool. Prior to version 2.1.7, Claude Code failed to strictly enforce deny rules configured in settings.json when accessing files through symbolic links. If a user explicitly denied Claude Code access to a file (such as /etc/passwd) and Claude Code had access to a symbolic link pointing to that file, it was possible for Claude Code to read the restricted file through the symlink without triggering deny rule enforcement. This issue has been patched in version 2.1.7.

Frequently asked questions

What is CVE-2026-25724?: Claude Code is an agentic coding tool. Prior to version 2.1.7, Claude Code failed to strictly enforce deny rules configured in settings.json when accessing files through symbolic links. If a user explicitly denied Claude Code access to a file (such as /etc/passwd) and Claude Code had access to a symbolic link pointing to that file, it was possible for Claude Code to read the restricted file through the symlink without triggering deny rule enforcement. This issue has been patched in version 2.1.7.
How severe is CVE-2026-25724?: CVE-2026-25724 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
Is CVE-2026-25724 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (30th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-25724?: CVE-2026-25724 affects Anthropic Claude Code. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-25724?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2026-25724 have an EU (EUVD) identifier?: Yes. CVE-2026-25724 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-5614.
When was CVE-2026-25724 published?: CVE-2026-25724 was published on 2026-02-06 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:anthropic:claude_code:*:*:*:*:*:node.js:*:*

More vulnerabilities in Anthropic Claude Code

CVE-2026-39861 — Critical (CVSS 10.0): Claude Code is an agentic coding tool. Prior to version 2.1.64, Claude Code's sandbox did not prevent sandboxed…
CVE-2026-25725 — Critical (CVSS 10.0): Claude Code is an agentic coding tool. Prior to version 2.1.2, Claude Code's bubblewrap sandboxing mechanism failed to…
CVE-2025-66032 — Critical (CVSS 9.8): Claude Code is an agentic coding tool. Prior to 1.0.93, Due to errors in parsing shell commands related to $IFS and…
CVE-2025-64755 — Critical (CVSS 9.8): Claude Code is an agentic coding tool. Prior to version 2.0.31, due to an error in sed command parsing, it was possible…
CVE-2025-65099 — Critical (CVSS 9.8): Claude Code is an agentic coding tool. Prior to version 1.0.39, when running on a machine with Yarn 3.0 or above,…
CVE-2025-59828 — Critical (CVSS 9.8): Claude Code is an agentic coding tool. Prior to Claude Code version 1.0.39, when using Claude Code with Yarn versions…

All CVEs affecting Anthropic Claude Code →

Other CWE-61 vulnerabilities

CVE-2026-34078 — Critical (CVSS 10.0): Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the Flatpak portal accepts paths…
CVE-2025-62596 — Critical (CVSS 10.0): Youki is a container runtime written in Rust. In versions 0.5.6 and below, youki’s apparmor handling performs…
CVE-2025-62161 — Critical (CVSS 10.0): Youki is a container runtime written in Rust. In versions 0.5.6 and below, the initial validation of the source…
CVE-2025-23394 — Critical (CVSS 9.8): A UNIX Symbolic Link (Symlink) Following vulnerability in openSUSE Tumbleweed cyrus-imapd allows escalation from cyrus…
CVE-2024-54661 — Critical (CVSS 9.8): readline.sh in socat before1.8.0.2 relies on the /tmp/$USER/stderr2 file.
CVE-2026-55447 — Critical (CVSS 9.6): Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.2, by controlling a files…

Browse all CWE-61 vulnerabilities →