Is CVE-2026-7005 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-7005 being exploited in the wild.

How severe is CVE-2026-7005?

Medium severity, with a CVSS score of 6.1, published 30 October 2026.

Which products and versions are affected?

WIT SynApps Runtime through 1.4.11.

Is there a fix for CVE-2026-7005?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-7005 attacked?

It is attacked over the network.

Am I affected by CVE-2026-7005?

Check whether you run WIT SynApps Runtime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-7005: WIT SynApps Runtime browser-mediated SSRF via controller onboarding

CVE-2026-7005 · Severity: medium · CVSS 6.1 · Published 2026-10-30

WIT SynApps Runtime is a cloud-delivered web interface that allows operators to manage internal REDY controllers from their browser. An attacker can manipulate the onboarding flow to trick a victim's browser into making requests to arbitrary internal or loopback addresses on the victim's network, potentially crossing security boundaries between IT and operational technology (OT) systems and discovering sensitive internal infrastructure.

Technologies: WIT SynApps Runtime. Vendors: WIT.

Quick answers

Is CVE-2026-7005 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-7005 being exploited in the wild.
How severe is CVE-2026-7005?: Medium severity, with a CVSS score of 6.1, published 30 October 2026.
Which products and versions are affected?: WIT SynApps Runtime through 1.4.11.
Is there a fix for CVE-2026-7005?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-7005 attacked?: It is attacked over the network.
Am I affected by CVE-2026-7005?: Check whether you run WIT SynApps Runtime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

CVE-2026-7005 is a browser-mediated cross-origin request forgery (CSRF) vulnerability in the SynApps Runtime host onboarding logic that permits an attacker to supply an arbitrary target address during controller discovery. The vulnerability allows the victim's browser to issue HTTP requests to attacker-specified hosts at paths such as /easy/GUI/Skins/Default/SiteLogo and /easy/GUI/Skins/Default/Identity, enabling network reconnaissance of loopback addresses, local hostnames, and internal-only network hosts. The attack exploits the architectural design where frontend code running in the operator's browser is trusted to reach internal REDY instances; no authentication bypass is required to probe the internal network through the victim's browser.

Affected products

WIT SynApps Runtime through 1.4.11

Timeline

2026-10-30: disclosed: Published by researcher Jean-Marie Bourbon
2026-10-30: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.