Cyber Resilience

CVE-2026-49252

Critical

Published: 18 June 2026

Published
18 June 2026
Modified
23 June 2026
KEV Added
—
Patch
—
CVSS Score v3.1 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
EPSS Score 0.0027 18.7th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2026-49252 is a critical-severity Prototype Pollution (CWE-1321) vulnerability. Its CVSS base score is 9.9 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 18.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. Versions prior to 10.0.5 are vulnerable to Prototype Pollution. Exploitation can lead to potential privilege escalation from any authenticated user…

more

with write permission to any record. This issue has been fixed in version 10.0.5.

CWE(s)
CWE-1321

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Prototype pollution vulnerability in the deepstream server application directly enables exploitation of a public-facing service for privilege escalation.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

Affected Assets

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References