CVE-2026-66564 ThemeREX CVE debrief

Who should care

Defenders responsible for ShiftCV deployments should assess exposure and prioritize remediation.

Why it matters

CVE-2026-66564 is a critical vulnerability in ShiftCV that requires immediate attention from defenders. The vulnerability allows for unauthenticated PHP object injection, which could lead to code execution and impact confidentiality, integrity, and availability. Defenders responsible for ShiftCV deployments should assess exposure and prioritize remediation.

• Potential for unauthenticated code execution
• Possible impact on confidentiality, integrity, and availability

Technical summary

CVE-2026-66564 is an unauthenticated PHP object injection vulnerability in ShiftCV version 3.0.14 and earlier. The vulnerability has a CVSS score of 9.8 and is considered critical.

Defensive priority

High

Recommended defensive actions

• Assess exposure of ShiftCV version 3.0.14 and earlier in your environment
• Prioritize remediation of vulnerable systems
• Verify inventory for potential impact

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further verification is required to determine the scope of affected systems and potential impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.