Is CVE-2026-110669 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-110669 being exploited in the wild.

How severe is CVE-2026-110669?

Medium severity, with a CVSS score of 6.5, published 14 October 2026.

Is there a fix for CVE-2026-110669?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-110669 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-110669?

Check whether you run Cemtan Sar2html at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-110669: cemtan sar2html missing authentication in destructive endpoints

CVE-2026-110669 · Severity: medium · CVSS 6.5 · Published 2026-10-14

sar2html is a system performance monitoring tool that displays historical statistics. The application exposes three endpoints that permanently delete data—including all historical records—without requiring any authentication. An attacker on the network can remotely delete all performance data with a simple HTTP request, causing loss of critical monitoring history.

Technologies: Cemtan Sar2html. Vendors: Cemtan.

Quick answers

Is CVE-2026-110669 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-110669 being exploited in the wild.
How severe is CVE-2026-110669?: Medium severity, with a CVSS score of 6.5, published 14 October 2026.
Which products and versions are affected?: Cemtan Sar2html 4.0.0.
Is there a fix for CVE-2026-110669?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-110669 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-110669?: Check whether you run Cemtan Sar2html at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The deleteHost, deleteRange, and deleteAll functions in sar2html.py lack authentication checks before executing destructive database operations (CWE-306). An unauthenticated remote attacker can send HTTP GET requests to /deleteHost, /deleteRange, or /deleteAll to permanently remove host data or the entire dataset. The application contains no login mechanism, session validation, or authorization checks on these routes.

Affected products

cemtan sar2html 4.0.0

Timeline

2026-09-28: disclosed
2026-10-14: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.