Is CVE-2026-76802 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-76802 being exploited in the wild.

How severe is CVE-2026-76802?

Medium severity, with a CVSS score of 4.7, published 22 September 2026.

Which products and versions are affected?

github.com/projectdiscovery/nuclei (Go) SEMVER:introduced=0; github.com/projectdiscovery/nuclei/v2 (Go) SEMVER:introduced=0; github.com/projectdiscovery/nuclei/v3 (Go) >= 3.0.0, < 3.10.0, SEMVER:introduced=3.0.0,fixed=3.10.0; ProjectDiscovery Nuclei before 3.10.0.

Is there a fix for CVE-2026-76802?

Yes. github.com/projectdiscovery/nuclei/v3 (Go): upgrade to 3.10.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-76802 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-76802?

Check whether you run github.com/projectdiscovery/nuclei (Go), github.com/projectdiscovery/nuclei/v2 (Go), github.com/projectdiscovery/nuclei/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-76802: ProjectDiscovery Nuclei arbitrary command execution in DAST template loading

Q: Is there a fix for CVE-2026-76802?

Yes. github.com/projectdiscovery/nuclei/v3 (Go): upgrade to 3.10.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-76802 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-76802?

Check whether you run github.com/projectdiscovery/nuclei (Go), github.com/projectdiscovery/nuclei/v2 (Go), github.com/projectdiscovery/nuclei/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-76802 · Severity: medium · CVSS 4.7 · Published 2026-09-22

Nuclei is a vulnerability scanning tool used by security teams to identify weaknesses in applications and infrastructure. A flaw in its DAST (dynamic application security testing) mode allows attackers to bypass the cryptographic signature requirement that normally prevents arbitrary code execution from untrusted templates. An attacker who can supply templates to a user running DAST scans can execute arbitrary shell commands on the scanning system.

Technologies: github.com/projectdiscovery/nuclei (Go), github.com/projectdiscovery/nuclei/v2 (Go), github.com/projectdiscovery/nuclei/v3 (Go), ProjectDiscovery Nuclei. Vendors: Go, ProjectDiscovery.

Quick answers

Is CVE-2026-76802 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-76802 being exploited in the wild.
How severe is CVE-2026-76802?: Medium severity, with a CVSS score of 4.7, published 22 September 2026.
Which products and versions are affected?: github.com/projectdiscovery/nuclei (Go) SEMVER:introduced=0; github.com/projectdiscovery/nuclei/v2 (Go) SEMVER:introduced=0; github.com/projectdiscovery/nuclei/v3 (Go) >= 3.0.0, < 3.10.0, SEMVER:introduced=3.0.0,fixed=3.10.0; ProjectDiscovery Nuclei before 3.10.0.
Is there a fix for CVE-2026-76802?: Yes. github.com/projectdiscovery/nuclei/v3 (Go): upgrade to 3.10.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-76802 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-76802?: Check whether you run github.com/projectdiscovery/nuclei (Go), github.com/projectdiscovery/nuclei/v2 (Go), github.com/projectdiscovery/nuclei/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/projectdiscovery/nuclei/v3 (Go): upgrade to 3.10.0 or later
```
go get github.com/projectdiscovery/nuclei/v3@v3.10.0
```

Technical details

The vulnerability is a code path bypass in Nuclei's template loader. The product requires `code:` protocol templates to be cryptographically signed before execution to prevent arbitrary command execution. However, when a template combines a `fuzzing:` block (triggering DAST-eligible logic) with an unsigned `code:` block, the DAST loader branch accepts the template without verifying signatures, bypassing the signature check present in the normal loading path. The attack requires explicit `-dast` flag enablement and attacker-controlled or untrusted templates containing both fuzzing and code blocks. An authenticated attacker or template supplier can achieve arbitrary shell command execution with the privileges of the Nuclei process. The fix is available in Nuclei v3.10.0 via patch https://github.com/projectdiscovery/nuclei/pull/7472.

Affected products

ProjectDiscovery Nuclei before 3.10.0

Identifiers

CVE-2026-76802
GHSA-jpf4-98qj-qr67
GO-2026-6570

Timeline

2026-09-22: disclosed
2026-09-22: patched: Fixed in Nuclei v3.10.0

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.