CVE-2026-8361
High
Published: 27 May 2026
Published
27 May 2026
Modified
27 May 2026
KEV Added
—
Patch
—
CVSS Score
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score
0.0004
13.7th percentile
Risk Priority
15
60% EPSS · 20% KEV · 20% CVSS
Summary
CVE-2026-8361 is a high-severity Relative Path Traversal (CWE-23) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 13.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Threat & Defense at a Glance
What attackers do: exploitation maps to Exploit Public-Facing Application (T1190).
Threat & Defense Details
MITRE ATT&CK Enterprise TechniquesAI
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?
Path traversal in web HTTP module (WOSDefaultHttpModule.dll) directly enables exploitation of a public-facing application via crafted URL paths.
Confidence: HIGH · MITRE ATT&CK Enterprise v18.1
NVD Description
A path traversal vulnerability exists in WOSDefaultHttpModule.dll when processing a URL path starting with /woshome
Deeper analysisAI
Automated synthesis unavailable for this CVE.
Details
- CWE(s)
- OWASP Top 10 Web 2025
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-32644