How severe is CVE-2026-93675?

CVE-2026-93675 has a CVSS 3.x base score of 8.8, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2026-93675 being actively exploited?

It is not currently listed in CISA's Known Exploited Vulnerabilities catalog, and no EPSS exploit-prediction score is available yet.

How do I fix CVE-2026-93675?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2026-93675 published?

CVE-2026-93675 was published on 2026-10-07.

CVE-2026-93675

CVE-2026-93675 is a high-severity vulnerability with a CVSS 3.x base score of 8.8. The underlying weakness is classified as CWE-440.

Key facts

Severity: High (CVSS 3.x base score 8.8)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-440
Published: 2026-10-07
Last modified: 2026-10-07

Description

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to an expected dependency confusion.

Frequently asked questions

What is CVE-2026-93675?: IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to an expected dependency confusion.
How severe is CVE-2026-93675?: CVE-2026-93675 has a CVSS 3.x base score of 8.8, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2026-93675 being actively exploited?: It is not currently listed in CISA's Known Exploited Vulnerabilities catalog, and no EPSS exploit-prediction score is available yet.
How do I fix CVE-2026-93675?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2026-93675 published?: CVE-2026-93675 was published on 2026-10-07.

References

https://www.ibm.com/support/pages/node/7290694

Other CWE-440 vulnerabilities

CVE-2019-6569 — Critical (CVSS 9.1): The monitor barrier of the affected products insufficiently blocks data from being forwarded over the mirror port into…
CVE-2024-32971 — Critical (CVSS 9.0): Apollo Router is a configurable, graph router written in Rust to run a federated supergraph that uses Apollo Federation…
CVE-2025-8850 — High (CVSS 8.8): In danny-avila/librechat version 0.7.9, there is an insecure API design issue in the 2-Factor Authentication (2FA)…
CVE-2026-8806 — High (CVSS 8.7): Expected Behavior Violation vulnerability in Mitsubishi Electric MELSEC iQ-F Series FX5-ENET/IP Ethernet Module…
CVE-2018-12550 — High (CVSS 8.1): When Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) is configured to use an ACL file, and that ACL file is empty,…
CVE-2023-4807 — High (CVSS 7.8): Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the…

Browse all CWE-440 vulnerabilities →