PatchSiren cyber security CVE debrief
CVE-2026-26422 Clash Verge Rev CVE debrief
CVE-2026-26422 is a HIGH severity vulnerability with a CVSS score of 8.4. The vulnerability exists in clash-verge-service-ipc before version 2.3.0 and allows for local privilege escalation due to a world-reachable IPC endpoint. The CVE was published on 2026-06-06T23:16:43.947Z and last modified on 2026-06-08T15:16:44.370Z.
- Vendor
- Clash Verge Rev
- Product
- clash-verge-service-ipc
- CVSS
- HIGH 8.4
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-06
- Original CVE updated
- 2026-06-08
- Advisory published
- 2026-06-06
- Advisory updated
- 2026-06-08
Who should care
Users of clash-verge-service-ipc before version 2.3.0 should be aware of this vulnerability and take steps to mitigate it.
Technical summary
The vulnerability is caused by a world-reachable IPC endpoint in clash-verge-service-ipc before version 2.3.0, which allows for local privilege escalation. The CVSS vector for this vulnerability is CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Defensive priority
HIGH
Recommended defensive actions
- Update clash-verge-service-ipc to version 2.3.0 or later.
- Restrict access to the IPC endpoint to prevent world-reachability.
Evidence notes
The vendor of the affected product is currently listed as Unknown Vendor. However, there is evidence suggesting the product may be related to Kaguranaku.
Official resources
CVE-2026-26422 was published on 2026-06-06T23:16:43.947Z and last modified on 2026-06-08T15:16:44.370Z.