Is CVE-2026-14890 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-14890 being exploited in the wild.

How severe is CVE-2026-14890?

Informational severity, with a CVSS score of 9.8, published 16 July 2026.

Which products and versions are affected?

SGLang Project SGLang <= 0.5.14.

Is there a fix for CVE-2026-14890?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-14890 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-14890?

Check whether you run SGLang Project SGLang at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-14890: SGLang remote code execution in expert-parallel backup subsystem

Q: Is there a fix for CVE-2026-14890?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-14890 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-14890?

Check whether you run SGLang Project SGLang at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-14890 · Severity: info · CVSS 9.8 · Published 2026-07-16

SGLang, a framework for serving large language models, contains a security vulnerability in its backup management component. An attacker can remotely execute unauthorized commands on the server because a network communication port lacks authentication and proper data validation. This could lead to a complete takeover of the AI serving infrastructure and exposure of sensitive model data.

Technologies: SGLang Project SGLang. Vendors: SGLang Project.

Quick answers

Is CVE-2026-14890 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-14890 being exploited in the wild.
How severe is CVE-2026-14890?: Informational severity, with a CVSS score of 9.8, published 16 July 2026.
Which products and versions are affected?: SGLang Project SGLang <= 0.5.14.
Is there a fix for CVE-2026-14890?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-14890 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-14890?: Check whether you run SGLang Project SGLang at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

SGLang (up to version 0.5.14) exposes a ZeroMQ PULL socket via its expert-parallel backup subsystem on a routable network interface. This socket lacks authentication and fails to implement deserialization safeguards when processing incoming data. An attacker can send a maliciously crafted Python pickle file to this port, leading to unauthenticated remote code execution (RCE). The vulnerability is present when the expert-parallel backup feature is enabled and the service is network-accessible. Security engineers should ensure the service is not exposed to untrusted networks and update to a patched version if available.

Affected products

SGLang Project SGLang <= 0.5.14

Timeline

2026-07-16: disclosed: Initial disclosure via NVD and CERT/CC
2026-07-16: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.