Is CVE-2026-109423 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-109423 being exploited in the wild.

How severe is CVE-2026-109423?

High severity, with a CVSS score of 7.4, published 12 October 2026.

Which products and versions are affected?

Netease Cloud Music 3.1.38, 3.1.39.205426.

Is there a fix for CVE-2026-109423?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-109423 attacked?

It is attacked from the adjacent network or over the network, in a web application.

Am I affected by CVE-2026-109423?

Check whether you run Netease Cloud Music at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-109423: NetEase Cloud Music Windows client TLS certificate validation bypass

CVE-2026-109423 · Severity: high · CVSS 7.4 · Published 2026-10-12

NetEase Cloud Music is a media player for Windows that streams music from NetEase's servers over HTTPS. The client fails to validate TLS certificates, allowing an attacker on the local network to intercept encrypted traffic, steal user session credentials, and modify music responses. Combined with other flaws, this enables account takeover and arbitrary code execution on the user's machine.

Technologies: Netease Cloud Music. Vendors: Netease.

Quick answers

Is CVE-2026-109423 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-109423 being exploited in the wild.
How severe is CVE-2026-109423?: High severity, with a CVSS score of 7.4, published 12 October 2026.
Which products and versions are affected?: Netease Cloud Music 3.1.38, 3.1.39.205426.
Is there a fix for CVE-2026-109423?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-109423 attacked?: It is attacked from the adjacent network or over the network, in a web application.
Am I affected by CVE-2026-109423?: Check whether you run Netease Cloud Music at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The affected versions (3.1.38 and 3.1.39.205426) do not enforce TLS certificate validation in their native networking stack used for music.163.com API traffic, accepting arbitrary MITM-generated certificates without hostname verification or certificate pinning (CWE-295). An attacker with network-adjacent position (same LAN, compromised router, rogue Wi-Fi) can decrypt HTTPS traffic and extract the MUSIC_U session cookie. This flaw chains with static-key response encryption (CWE-321) and unsafe HTML rendering in update notifications (CWE-79) to enable remote command execution via file:// URI handler (CWE-939) without user interaction.

Affected products

NetEase Cloud Music 3.1.38, 3.1.39.205426

Timeline

2026-09-08: disclosed: Reported to NetEase Security Response Center
2026-10-12: advisory: CVE-2026-109423 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.