Cyber Posture

CVE-2026-3826

Critical

Published: 11 March 2026

Published
11 March 2026
Modified
17 March 2026
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0029 52.3th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

IFTOP developed by WellChoose has a Local File Inclusion vulnerability, allowing unauthenticated remote attackers to execute arbitrary code on the server.

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly prevents LFI exploitation by validating and sanitizing user-supplied file paths before inclusion in IFTOP.

prevent

Requires timely patching of the specific LFI vulnerability in IFTOP to eliminate the flaw enabling arbitrary code execution.

prevent

Enforces least privilege to limit the damage from arbitrary code execution achieved via the LFI vulnerability.

Security SummaryAI

CVE-2026-3826 is a Local File Inclusion (LFI) vulnerability, classified under CWE-98, in IFTOP, a network monitoring tool developed by WellChoose. Published on 2026-03-11, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical due to its potential for severe impact.

Unauthenticated remote attackers can exploit this vulnerability over the network with low attack complexity, requiring no privileges, user interaction, or special conditions. Successful exploitation enables arbitrary code execution on the server, compromising confidentiality, integrity, and availability to a high degree.

Mitigation guidance is available in advisories from Taiwan's CERT, including https://www.twcert.org.tw/en/cp-139-10756-73f66-2.html and https://www.twcert.org.tw/tw/cp-132-10755-94136-1.html.

Details

CWE(s)

Affected Products

wellchoose
organization portal system
≤ iftop_p4_181

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

The LFI vulnerability in the network monitoring tool IFTOP allows unauthenticated remote attackers to achieve arbitrary code execution over the network, directly mapping to exploitation of a public-facing application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References