Is CVE-2026-76131 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-76131 being exploited in the wild.

How severe is CVE-2026-76131?

Medium severity, with a CVSS score of 5.3, published 21 August 2026.

Which products and versions are affected?

Yamaha VOCALOID6 Editor 6.13.0 and earlier.

Is there a fix for CVE-2026-76131?

A patch was published on 2026-09-16: VOCALOID6 Editor version 6.13.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-76131 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-76131?

Check whether you run Yamaha VOCALOID6 Editor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-76131: Yamaha VOCALOID6 hard-coded credentials in Editor

CVE-2026-76131 · Severity: medium · CVSS 5.3 · Published 2026-08-21

VOCALOID6 Editor is a music production software used to create synthetic vocals for compositions. An attacker can exploit hard-coded credentials embedded in the application to impersonate legitimate users and gain unauthorized access to Yamaha's activation and content servers, potentially enabling unauthorized downloads, account takeover, or service abuse.

Technologies: Yamaha VOCALOID6 Editor. Vendors: Yamaha.

Quick answers

Is CVE-2026-76131 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-76131 being exploited in the wild.
How severe is CVE-2026-76131?: Medium severity, with a CVSS score of 5.3, published 21 August 2026.
Which products and versions are affected?: Yamaha VOCALOID6 Editor 6.13.0 and earlier.
Is there a fix for CVE-2026-76131?: A patch was published on 2026-09-16: VOCALOID6 Editor version 6.13.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-76131 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-76131?: Check whether you run Yamaha VOCALOID6 Editor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a hard-coded credentials issue (CWE-798) in VOCALOID6 Editor versions 6.13.0 and earlier. An attacker with network access can exploit embedded credentials to impersonate the VOCALOID6 Editor and authenticate to Yamaha's activation and content servers without valid user credentials. The vulnerability requires no authentication or user interaction and allows information disclosure (confidentiality impact). The vendor released VOCALOID6 Editor version 6.13.3 on September 16, 2026, which is presumed to address this vulnerability.

Affected products

Yamaha VOCALOID6 Editor 6.13.0 and earlier

Timeline

2026-08-21: disclosed
2026-09-16: patched: VOCALOID6 Editor version 6.13.3 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.