Is CVE-2026-44196 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44196 being exploited in the wild.

How severe is CVE-2026-44196?

Critical severity, with a CVSS score of 9.1, published 12 May 2026.

Which products and versions are affected?

Smp46 Pingvin Share 1.14.1 - 1.16.2.

Is there a fix for CVE-2026-44196?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-44196 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-44196?

Check whether you run Smp46 Pingvin Share at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44196: Pingvin Share X TOTP authentication bypass

CVE-2026-44196 · Severity: critical · CVSS 9.1 · Published 2026-05-12

Pingvin Share X is a self-hosted file sharing platform used to manage and distribute large files. A security flaw allows attackers who have stolen a user's password to completely bypass the required second-factor authentication (TOTP). This could lead to unauthorized access to sensitive files, data theft, and full account takeover.

Vendors: Smp46.

Quick answers

Is CVE-2026-44196 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44196 being exploited in the wild.
How severe is CVE-2026-44196?: Critical severity, with a CVSS score of 9.1, published 12 May 2026.
Which products and versions are affected?: Smp46 Pingvin Share 1.14.1 - 1.16.2.
Is there a fix for CVE-2026-44196?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-44196 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-44196?: Check whether you run Smp46 Pingvin Share at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authentication bypass vulnerability exists in Pingvin Share X due to improper authentication (CWE-287) and incorrect comparison logic (CWE-697) during the login flow. While the platform requires a password, it fails to properly enforce the Time-based One-Time Password (TOTP) second-factor requirement. A remote attacker with valid primary credentials can bypass the 2FA stage to gain full access to the account. This allows for unauthorized management of shares and access to stored data, including S3-backed storage. The issue is resolved in version 1.16.3.

Affected products

smp46 Pingvin Share X 1.14.1 - 1.16.2

Timeline

2026-04-27: advisory: Original GitHub advisory published
2026-05-12: disclosed: NVD publication date

References

https://github.com/smp46/pingvin-share-x/security/advisories/GHSA-j679-vp39-qwqq

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.