Cyber Resilience

CVE-2026-23498

HighRCE

Published: 14 January 2026

Published
14 January 2026
Modified
28 January 2026
KEV Added
Patch
CVSS Score v3.1 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0003 8.1th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-23498 is a high-severity Code Injection (CWE-94) vulnerability in Shopware Shopware. Its CVSS base score is 7.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 8.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-23498 is a code injection vulnerability (CWE-94) affecting Shopware, an open commerce platform. It stems from a regression of CVE-2023-2017 in versions 6.7.0.0 through 6.7.6.0, where an array-crafted PHP Closure is not properly checked against an allow list in the map(...) override function. The issue has a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and was published on 2026-01-14.

An authenticated attacker with high privileges, such as an administrator, can exploit this vulnerability remotely with low complexity and no user interaction required. Successful exploitation allows high-impact compromise, including unauthorized access to sensitive data (C:H), modification of system integrity (I:H), and disruption of availability (A:H), potentially leading to full server control within the affected scope.

Shopware's security advisory (GHSA-7cw6-7h3h-v8pf) and the fixing commit (3966b05590e29432b8485ba47b4fcd14dd0b8475) confirm the vulnerability is patched in version 6.7.6.1. Security practitioners should prioritize upgrading affected Shopware instances to 6.7.6.1 or later to mitigate the risk.

EU & UK References

Vulnerability details

Shopware is an open commerce platform. From 6.7.0.0 to before 6.7.6.1, a regression of CVE-2023-2017 leads to an array and array crafted PHP Closure not checked being against allow list for the map(...) override. This vulnerability is fixed in 6.7.6.1.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Direct remote code injection (CWE-94) in publicly accessible Shopware web application enables exploitation of public-facing apps for arbitrary code execution and full server compromise.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2026-31887Same product: Shopware Shopware
CVE-2026-31889Same product: Shopware Shopware
CVE-2025-13773Shared CWE-94
CVE-2025-50692Shared CWE-94
CVE-2026-30643Shared CWE-94
CVE-2026-30460Shared CWE-94
CVE-2025-71243Shared CWE-94
CVE-2026-44262Shared CWE-94
CVE-2024-13792Shared CWE-94
CVE-2020-37052Shared CWE-94

Affected Assets

shopware
shopware
6.7.0.0 — 6.7.6.1

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly requires validation of inputs against an allow list, which is the exact control failure that permits the crafted PHP Closure in the map() override.

prevent

Mandates timely remediation of known flaws; applying the 6.7.6.1 patch eliminates the regression of CVE-2023-2017.

prevent

Restricts the set of privileged accounts that can reach the vulnerable map() function, reducing the population able to supply the malicious Closure.

References