CVE-2026-8361
High
Published: 27 May 2026
Published
27 May 2026
Modified
29 May 2026
KEV Added
—
Patch
—
CVSS Score v3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score
0.0035
26.8th percentile
Risk Priority
15
60% EPSS · 20% KEV · 20% CVSS
Summary
CVE-2026-8361 is a high-severity Relative Path Traversal (CWE-23) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 26.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-32644
Vulnerability details
A path traversal vulnerability exists in WOSDefaultHttpModule.dll when processing a URL path starting with /woshome
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?
Path traversal in web HTTP module (WOSDefaultHttpModule.dll) directly enables exploitation of a public-facing application via crafted URL paths.
Confidence: HIGH · MITRE ATT&CK Enterprise v18.1
CVEs Like This One
CVE-2025-25130Shared CWE-23
CVE-2026-25057Shared CWE-23
CVE-2026-33494Shared CWE-23
CVE-2025-20059Shared CWE-23
CVE-2025-7619Shared CWE-23
CVE-2024-8551Shared CWE-23
CVE-2025-2056Shared CWE-23
CVE-2026-1022Shared CWE-23
CVE-2025-54317Shared CWE-23
CVE-2026-43533Shared CWE-23
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.