Is CVE-2026-7261 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-7261 being exploited in the wild.

How severe is CVE-2026-7261?

Critical severity, with a CVSS score of 9.8, published 10 May 2026.

Which products and versions are affected?

PHP Group PHP 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, 8.2.0 - 8.2.30, 8.3.0 - 8.3.30, 8.4.0 - 8.4.20, 8.5.0 - 8.5.5.

Is there a fix for CVE-2026-7261?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-7261 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-7261?

Check whether you run PHP Group PHP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-7261: PHP SoapServer use-after-free in SOAP_PERSISTENCE_SESSION

CVE-2026-7261 · Severity: critical · CVSS 9.8 · Published 2026-05-10

PHP is a widely used programming language for web development. A vulnerability in its SOAP (Simple Object Access Protocol) component could allow an attacker to cause system crashes, steal sensitive information, or potentially execute unauthorized code. This occurs when a web service is configured to remember user sessions and encounters a specific type of error during communication.

Technologies: PHP Group PHP. Vendors: PHP Group.

Quick answers

Is CVE-2026-7261 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-7261 being exploited in the wild.
How severe is CVE-2026-7261?: Critical severity, with a CVSS score of 9.8, published 10 May 2026.
Which products and versions are affected?: PHP Group PHP 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, 8.2.0 - 8.2.30, 8.3.0 - 8.3.30, 8.4.0 - 8.4.20, 8.5.0 - 8.5.5.
Is there a fix for CVE-2026-7261?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-7261 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-7261?: Check whether you run PHP Group PHP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A use-after-free vulnerability exists in PHP's SoapServer component (ext/soap) when SOAP_PERSISTENCE_SESSION is enabled. The root cause is a failure in soap.c to account for the persistence flag during error handling; specifically, when a handler function for a SOAP header node returns false or throws an exception, the handler object is prematurely freed while a pointer to it remains in session storage. When the session is subsequently written, the freed memory is accessed. This can be triggered by a remote, unauthenticated attacker sending a specially crafted SOAP request with a malicious header. The vulnerability can lead to memory corruption, process crashes, or information disclosure. Patches are available in PHP versions 8.2.31, 8.3.31, 8.4.21, and 8.5.6.

Affected products

PHP Group PHP 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6

Timeline

2026-05-07: advisory: Original GitHub advisory published by PHP Group
2026-05-10: disclosed: NVD publication date

References

https://github.com/php/php-src/security/advisories/GHSA-m33r-qmcv-p97q

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.