Cyber Posture

CVE-2026-45102

Critical
Microsoft: not affectedMSmacOS: not affectedMacLinux: not affectedLnxMobile: not affectedMobNetwork: not affectedNetApplication: not affectedAppOther: affectedOth

Published: 27 May 2026

Published
27 May 2026
Modified
27 May 2026
KEV Added
—
Patch
—
CVSS Score 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0006 17.6th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-45102 is a critical-severity Protection Mechanism Failure (CWE-693) vulnerability. Its CVSS base score is 9.9 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 17.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique.
Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

AC-25 Reference Monitor
addresses: CWE-693

Implements a reliable, tamperproof protection mechanism whose completeness can be assured.

AT-1 Policy and Procedures
addresses: CWE-693

Procedures for training on protection mechanisms reduce the chance of protection mechanism failures being present or exploitable.

CA-1 Policy and Procedures
addresses: CWE-693

Documented procedures to implement assessment, authorization, and monitoring controls prevent these protection mechanisms from failing due to undefined processes.

CA-2 Control Assessments
addresses: CWE-693

Direct evaluation of whether controls produce desired security outcomes detects protection mechanism failures and enables remediation.

CA-4 Security Certification
addresses: CWE-693

Requires assessment that protection mechanisms are correctly implemented and producing intended security outcomes.

CA-5 Plan of Action and Milestones
addresses: CWE-693

The POA&M process ensures identified weaknesses in protection mechanisms are documented and scheduled for remediation, reducing the duration they remain exploitable.

CA-7 Continuous Monitoring
addresses: CWE-693

Ongoing control assessments and analysis of monitoring data enable timely detection and response when protection mechanisms fail.

CM-4 Impact Analyses
addresses: CWE-693

Impact analysis identifies changes that could weaken or disable existing protection mechanisms.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.007 JavaScript Execution
Adversaries may abuse various implementations of JavaScript for execution.
attack.mitre.org →
Why these techniques?

Sandbox escape in Node.js vm module directly enables RCE on public-facing OneUptime server via JavaScript execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

OneUptime is an open-source monitoring and observability platform. Prior to 10.0.98, OneUptime uses the Node.js' vm module as an isolation primitive. This API was not designed for that and can be escaped via error objects and infinite recursion. This vulnerability…

more

is fixed in 10.0.98.

Deeper analysisAI

Automated synthesis unavailable for this CVE.

Details

CWE(s)
CWE-693
OWASP Top 10 Web 2025
A06:2025

EU & UK References

Regulatory context (EU CRA / NIS2 / DORA / UK NIS Regulations)

EU Cyber Resilience Act — coordinated disclosure

Critical and high-severity vulnerabilities in products with digital elements may trigger coordinated-disclosure obligations under the EU Cyber Resilience Act (CRA, Regulation 2024/2847). Manufacturers placing products on the EU market must notify ENISA and the relevant CSIRTs without undue delay once active exploitation is known.

References