Cyber Resilience

CVE-2026-41013

HighUpdated

Published: 01 June 2026

Published
01 June 2026
Modified
17 June 2026
KEV Added
Patch
CVSS Score v3.1 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS Score 0.0024 14.9th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-41013 is a high-severity Argument Injection (CWE-88) vulnerability. Its CVSS base score is 8.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 14.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability details

Input validation bypass in SMB volume mount handling in CloudFoundry Foundation diego-release allows low-privileged CF space developer to inject arbitrary kernel CIFS mount options via bypassing the mount-option allowlist, enabling privilege escalation and security control bypass on multi-tenant Diego cells.…

more

Affected versions: smb-volume-release: All versions prior to v3.60.0 CF Deployment: All versions prior to v56.0.0

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

Input validation bypass enables direct exploitation for privilege escalation via arbitrary CIFS mount option injection on multi-tenant cells.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-15316Shared CWE-88
CVE-2025-0065Shared CWE-88
CVE-2026-0634Shared CWE-88
CVE-2025-15315Shared CWE-88
CVE-2026-4145Shared CWE-88
CVE-2026-1715Shared CWE-88
CVE-2025-12556Shared CWE-88
CVE-2026-24061Shared CWE-88
CVE-2026-44193Shared CWE-88
CVE-2026-22582Shared CWE-88

Affected Assets

Affected
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References