CVE-2026-111324

Medium · CVSS 6.9

Published 2026-10-15

CVSS

6.9

Medium

EPSS

—

exploit probability

Active Exploit

not yet listed

Medium — next window — Medium severity. Include in your next scheduled maintenance window.

What is CVE-2026-111324?

rustdesk-api through 2.7 contains an authorization bypass vulnerability that allows unauthenticated attackers to overwrite existing peer records by supplying only a target device ID to POST /api/sysinfo. Attackers can overwrite hostname, username, OS and uuid without uuid verification, then log in presenting that uuid to rebind the peer to their account.

CVSS Score Explained

CVSS 6.9 is Medium severity. Exploitation usually requires some specific conditions (local access, user interaction, or a particular config). Still worth patching in your next maintenance window.

EPSS Exploitation Probability

No EPSS score yet — model needs more data on this CVE.

References & Patches

Track vulnerabilities for your stack

Tell us what tech you run — Node.js, Python, Java, nginx, whatever — and get a weekly email when new CVEs affect it.

Set up my stack watchlist What is a CVE?

Recent CVEs

Browse all CVEs →CISA KEV list →My watchlist →