Is CVE-2026-26718 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-26718 being exploited in the wild.

How severe is CVE-2026-26718?

Informational severity, with a CVSS score of 8.8, published 15 July 2026.

Which products and versions are affected?

XXL-JOB-ADMIN 3.0.0, versions prior to 3.4.0.

Is there a fix for CVE-2026-26718?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-26718 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-26718?

Check whether you run XXL-JOB-ADMIN at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-26718: xxl-job-admin CSRF in Glue IDE shell scripts

CVE-2026-26718 · Severity: info · CVSS 8.8 · Published 2026-07-15

A security vulnerability exists in xxl-job-admin, a popular distributed task scheduling framework. An attacker can trick a logged-in administrator into visiting a malicious website, which then silently forces the administrator's browser to modify internal automation scripts. This could allow an attacker to execute unauthorized commands on the server, potentially leading to a full system takeover or data theft.

Vendors: XXL-JOB.

Quick answers

Is CVE-2026-26718 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-26718 being exploited in the wild.
How severe is CVE-2026-26718?: Informational severity, with a CVSS score of 8.8, published 15 July 2026.
Which products and versions are affected?: XXL-JOB-ADMIN 3.0.0, versions prior to 3.4.0.
Is there a fix for CVE-2026-26718?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-26718 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-26718?: Check whether you run XXL-JOB-ADMIN at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in the xxl-job-admin web application (specifically version 3.0.0 and versions prior to 3.4.0). The root cause is a lack of proper CSRF token validation on the '/jobcode/save' endpoint, combined with a permissive request mapping that accepts arbitrary HTTP methods. An attacker can exploit this by inducing an authenticated administrator to interact with a malicious webpage, which then submits a hidden form to the vulnerable endpoint. This allows the attacker to overwrite Glue IDE shell scripts with malicious code, leading to Remote Code Execution (RCE) when the scheduled job is next triggered.

Affected products

xxl-job xxl-job-admin 3.0.0, versions prior to 3.4.0

Timeline

2026-07-15: advisory: NVD publication date
2026-07-15: disclosed: Public disclosure of vulnerability and PoC by Ibrahim Sartawi

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.