Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 9.8 | Critical | 3.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | CNA (GitHub_M) |
- CISA KEV Not listed.
- EPSS 0.0071, the 53rd percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 5 May 2026, 16:33 UTC Confirmed by GitHub Advisory Database
- 4 Nov 2026, 03:45 UTC Confirmed by OSV
Sources
- GitHub Advisory Database: GHSA-55hx-c926-fr95
- OSV: GHSA-55hx-c926-fr95
- github.com/patriksimek/vm2/security/advisories/GHSA-55hx-c926-fr95
- nvd.nist.gov/vuln/detail/CVE-2026-26332
- github.com/patriksimek/vm2/commit/119fd0aa1e4c27b08cf37946b2dafa99e2c754f0
- github.com/patriksimek/vm2/commit/4cb82cc94d9bb6c9a918b45f8c6790c32a5e913f
- github.com/patriksimek/vm2/commit/7395c3a4b01d302e55271c87dbeb44d6b83b81ca
- github.com/patriksimek/vm2/commit/792e16d56ee429ab19e284ed9c545f5e4694fb7d
- github.com/patriksimek/vm2/commit/d715dd88c5aec5bbb4dce03ddf7c3eb3791d0338
- access.redhat.com/security/cve/CVE-2026-26332
- bugzilla.redhat.com/show_bug.cgi?id=2466508
- github.com/patriksimek/vm2
- github.com/patriksimek/vm2/releases/tag/v3.11.0
- security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26332.json