CVE-2026-36340

HighRCE

Published: 30 April 2026

Published

30 April 2026

Modified

30 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS Score 0.0057 42.8th percentile

Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-36340 is a high-severity Code Injection (CWE-94) vulnerability in Google (inferred from references). Its CVSS base score is 8.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 42.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-36340 is a code injection vulnerability (CWE-94) affecting Krayin CRM version 2.1.5, enabling remote arbitrary code execution through the compose email function. The flaw has a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), indicating high severity due to network accessibility, low attack complexity, and requirements for low-privileged user access, with significant impacts on confidentiality and integrity but no availability disruption. It was published on 2026-04-30 and resolved in Krayin CRM version 2.1.6.

An authenticated attacker with low privileges (PR:L) can exploit this vulnerability remotely over the network without user interaction. By targeting the compose email function, the attacker injects and executes arbitrary code, potentially leading to full compromise of the application, data exfiltration, or further lateral movement within the environment.

Mitigation is available via the official patch in Krayin CRM v2.1.6, as detailed in the project's GitHub release notes at https://github.com/krayin/laravel-crm/releases/tag/v2.1.6. Additional resources include proof-of-concept details and analysis from https://github.com/cybercrewinc/CVE-2026-36340 and a related file at https://drive.google.com/file/d/1yBdvbrXGf9fsFckmK9zTe2v8_vDtdicH/view. Security practitioners should prioritize updating affected instances and review access controls for email composition features.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-26382

Vulnerability details

An issue in Krayin CRM v.2.1.5 and fixed in v.2.1.6 allows a remote attacker to execute arbitrary code via the compose email function

CWE(s): CWE-94

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1059 Command and Scripting Interpreter Execution

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.

attack.mitre.org →

Why these techniques?

Code injection (CWE-94) in web app compose email function enables remote arbitrary code execution (RCE) with low-priv auth, directly mapping to T1190 for exploiting public-facing application and T1059 for command/script execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0