Is CVE-2026-66420 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-66420 being exploited in the wild.

How severe is CVE-2026-66420?

High severity, with a CVSS score of 8.8, published 30 July 2026.

Which products and versions are affected?

Ylianst MeshCentral 1.1.21 and earlier.

Is there a fix for CVE-2026-66420?

A patch was published on 2026-06-08: Fix merged into master branch via pull request 7882 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-66420 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-66420?

Check whether you run Ylianst MeshCentral at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-66420: MeshCentral WebSocket hijacking bypass in webserver.js

CVE-2026-66420 · Severity: high · CVSS 8.8 · Published 2026-07-30

MeshCentral is a remote management platform used to monitor and control computers and devices over the internet. A security flaw in how the software verifies web connections allows an attacker to hijack an administrator's session if the server uses self-signed security certificates. If exploited, an attacker could gain full remote control over all devices managed by the server, potentially leading to data theft or unauthorized access to corporate infrastructure.

Technologies: Ylianst MeshCentral. Vendors: Ylianst.

Quick answers

Is CVE-2026-66420 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-66420 being exploited in the wild.
How severe is CVE-2026-66420?: High severity, with a CVSS score of 8.8, published 30 July 2026.
Which products and versions are affected?: Ylianst MeshCentral 1.1.21 and earlier.
Is there a fix for CVE-2026-66420?: A patch was published on 2026-06-08: Fix merged into master branch via pull request 7882 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-66420 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-66420?: Check whether you run Ylianst MeshCentral at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Cross-Site WebSocket Hijacking (CSWSH) vulnerability exists in MeshCentral due to an origin validation error in the CheckWebServerOriginName() function within webserver.js. When self-signed certificates are used, the function performs an unconditional early return of 'true', effectively bypassing origin checks. An unauthenticated remote attacker can entice an authenticated user to visit a malicious site, which then opens cross-origin WebSocket connections to the MeshCentral server. This allows the attacker to exfiltrate the server's sessionKey, forge session tokens for any user, and achieve full administrative control over the instance and its managed endpoints. The issue was addressed in June 2026 by replacing direct certificate CommonName comparisons with a more robust hostname validation method.

Affected products

Ylianst MeshCentral 1.1.21 and earlier

Timeline

2026-06-08: patched: Fix merged into master branch via pull request 7882
2026-07-30: disclosed: CVE-2026-66420 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.