How severe is CVE-2026-92963?

CVE-2026-92963 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.

Is CVE-2026-92963 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (27th percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2026-92963?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2026-92963 published?

CVE-2026-92963 was published on 2026-09-17 and last updated on 2026-09-18.

CVE-2026-92963

CVE-2026-92963 is a medium-severity vulnerability with a CVSS 3.x base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-227.

Key facts

Severity: Medium (CVSS 3.x base score 5.3)
CVSS v4: 6.9
EPSS exploit prediction: 0% (27th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-227
Published: 2026-09-17
Last modified: 2026-09-18

Description

vm2 versions before 3.11.2 fail to properly restrict access to the VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL global variable. Attackers can access this internal state object through globalThis to retrieve sensitive sandbox internals.

Frequently asked questions

What is CVE-2026-92963?: vm2 versions before 3.11.2 fail to properly restrict access to the VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL global variable. Attackers can access this internal state object through globalThis to retrieve sensitive sandbox internals.
How severe is CVE-2026-92963?: CVE-2026-92963 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.
Is CVE-2026-92963 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (27th percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2026-92963?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2026-92963 published?: CVE-2026-92963 was published on 2026-09-17 and last updated on 2026-09-18.

References

Other CWE-227 vulnerabilities

CVE-2023-41293 — High (CVSS 7.5): Data security classification vulnerability in the DDMP module. Successful exploitation of this vulnerability may affect…
CVE-2024-56442 — Medium (CVSS 5.5): Vulnerability of native APIs not being implemented in the NFC service module Impact: Successful exploitation of this…

Browse all CWE-227 vulnerabilities →