CVE-2026-92718

Nuclei from 3.7.0 before 3.11.1 Template Signature Bypass via Modification-Time-Only Cache

7.0 High

Nuclei versions before 3.11.1 cache template signature verification based only on file modification time without content checksums. Attackers can replace verified templates with unsigned malicious content and restore the original modification time to bypass signature checks and execute arbitrary operating system commands.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: Passive

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.12%Unchanged since Sep 17, 2026

What each source reports

CVE List Score used 7.0

Nuclei from 3.7.0 before 3.11.1 Template Signature Bypass via Modification-Time-Only Cache

Record: CVE-2026-92718
CVSS 4.0: 7.0 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 7.3 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-347
Updated: 2026-11-02

EUVDEUVD-2026-80901 7.0

Record: EUVD-2026-80901
CVSS 4.0: 7.0 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-77rj-h8wx-6cgq 7.0

Nuclei versions before 3.11.1 cache template signature verification based only on file...

Record: GHSA-77rj-h8wx-6cgq
CVSS 4.0: 7.0 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 7.3 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-347
Updated: 2026-11-02

NVD 7.0

Record: CVE-2026-92718
CVSS 4.0: 7.0 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 7.3 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-347
Updated: 2026-11-02

OSV 7.0

Nuclei from 3.7.0 before 3.11.1 Template Signature Bypass via Modification-Time-Only Cache

Record: CVE-2026-92718
CVSS 4.0: 7.0 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness: CWE-347
Updated: 2026-11-02

Affected products

projectdiscovery nuclei

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-92718 is a high vulnerability (CVSS 7.0) in Projectdiscovery Nuclei, published September 16, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.12%, the 1st percentile. No source names a fixed version.