PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-42569 phpvms CVE debrief

CVE-2026-42569 is a critical phpVMS vulnerability affecting versions before 7.0.6. According to the source record, unauthenticated users could access a legacy import feature, and the issue was patched in 7.0.6. The NVD entry rates the issue 9.4/Critical and records a network-reachable, no-authentication attack path.

Vendor
phpvms
Product
Unknown
CVSS
CRITICAL 9.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-09
Original CVE updated
2026-07-20
Advisory published
2026-05-09
Advisory updated
2026-07-20

Who should care

Administrators, maintainers, and operators of phpVMS instances running any version earlier than 7.0.6 should treat this as urgent. Security teams should also review any internet-facing deployments and any environments that expose legacy import functionality.

Technical summary

The source corpus describes an unauthenticated access flaw in a legacy import feature in phpVMS versions before 7.0.6. NVD records the CVSS v3.1 vector as AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H, which indicates a remotely reachable issue requiring no privileges or user interaction. The advisory metadata maps the weakness to CWE-284, CWE-306, and CWE-862.

Defensive priority

Critical. This is a high-severity remote issue with no authentication required and a published fix available. Prioritize upgrading exposed systems first, then validate whether any unauthorized import activity occurred before remediation.

Recommended defensive actions

  • Upgrade phpVMS to version 7.0.6 or later as the primary remediation step.
  • If you are already on a newer release, confirm the instance includes the fix and is not pinned to a vulnerable 7.0.6-predecessor build.
  • Review access logs and application audit trails for unexpected use of legacy import functionality.
  • Temporarily restrict exposure of administrative or import-related endpoints until patching is complete.
  • Check for unauthorized data imports or configuration changes that may have occurred before remediation.

Evidence notes

The NVD record for CVE-2026-42569 identifies the vulnerability as a critical phpVMS issue with publication and modification timestamps of 2026-05-09T20:16:29.127Z. The provided description states that prior to version 7.0.6, unauthenticated access to a legacy import feature was possible and that the issue was patched in 7.0.6. GitHub references in the corpus include the fixing commit, the 7.0.6 release, the 7.0.7 release, and the GitHub Security Advisory GHSA-fv26-4939-62fh.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-42569 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-42569

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-42569 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-42569

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.