How severe is CVE-2026-84149?

CVE-2026-84149 has a CVSS 4.0 base score of 9.2, rated critical severity.

Is CVE-2026-84149 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (44th percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2026-84149?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2026-84149 published?

CVE-2026-84149 was published on 2026-09-01.

CVE-2026-84149

CVE-2026-84149 is a critical-severity vulnerability with a CVSS 4.0 base score of 9.2. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-527.

Key facts

Severity: Critical (CVSS 4.0 base score 9.2)
EPSS exploit prediction: 1% (44th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-527
Published: 2026-09-01
Last modified: 2026-09-01

Description

This vulnerability exists in the ERP system due to exposure of repository information through a publicly accessible .git directory. An unauthenticated remote attacker could exploit this vulnerability by accessing the exposed .git directory and retrieving repository metadata and associated files, which could allow reconstruction of the application's source code.

Frequently asked questions

What is CVE-2026-84149?: This vulnerability exists in the ERP system due to exposure of repository information through a publicly accessible .git directory. An unauthenticated remote attacker could exploit this vulnerability by accessing the exposed .git directory and retrieving repository metadata and associated files, which could allow reconstruction of the application's source code.
How severe is CVE-2026-84149?: CVE-2026-84149 has a CVSS 4.0 base score of 9.2, rated critical severity.
Is CVE-2026-84149 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (44th percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2026-84149?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
When was CVE-2026-84149 published?: CVE-2026-84149 was published on 2026-09-01.

References

https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0430

Other CWE-527 vulnerabilities

CVE-2021-21423 — Medium (CVSS 6.8): `projen` is a project generation tool that synthesizes project configuration files such as `package.json`,…
CVE-2022-20931 — Medium (CVSS 6.5): A vulnerability in the version control of Cisco TelePresence CE Software for Cisco Touch 10 Devices could…

Browse all CWE-527 vulnerabilities →