Is CVE-2026-18749 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-18749 being exploited in the wild.

How severe is CVE-2026-18749?

Critical severity, with a CVSS score of 9.8, published 12 August 2026.

Which products and versions are affected?

CERT/CC VINCE 3.0.44 and earlier.

Is there a fix for CVE-2026-18749?

A patch was published on 2026-08-13: Fix merged in PR #235 (version 3.0.44 or later) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-18749 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-18749?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-18749: CERT/CC VINCE authorization bypass in VinceTrackAttachment

CVE-2026-18749 · Severity: critical · CVSS 9.8 · Published 2026-08-12

VINCE is a web-based platform used by the CERT Coordination Center to manage coordinated vulnerability disclosure between vendors and security researchers. The vulnerability allows case members to retrieve confidential case artefacts (such as vulnerability details and technical materials) uploaded by coordinators before they have been intentionally released to other participants — potentially exposing sensitive, embargoed disclosure information to vendors prematurely.

Quick answers

Is CVE-2026-18749 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-18749 being exploited in the wild.
How severe is CVE-2026-18749?: Critical severity, with a CVSS score of 9.8, published 12 August 2026.
Which products and versions are affected?: CERT/CC VINCE 3.0.44 and earlier.
Is there a fix for CVE-2026-18749?: A patch was published on 2026-08-13: Fix merged in PR #235 (version 3.0.44 or later) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-18749 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-18749?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authorization bypass in the type=track endpoint that checks only whether the requesting user is a member of the case (_is_my_case) but fails to verify the VinceTrackAttachment.shared flag. An attacker with membership in a case can retrieve any non-shared case artefact by providing its UUID, even if that artefact was uploaded by a coordinator and marked confidential. The attack requires network access to the VINCE web platform and valid case membership. This bypass allows unauthorized disclosure of not-yet-released coordinator material (vulnerability reports, technical analysis, embargo agreements) to vendors participating in the case.

Affected products

CERT/CC VINCE 3.0.44 and earlier

Timeline

2026-08-12: disclosed: CVE published on NVD
2026-08-13: patched: Fix merged in PR #235 (version 3.0.44 or later)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.