Is CVE-2026-96763 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-96763 being exploited in the wild.

How severe is CVE-2026-96763?

Medium severity, with a CVSS score of 5.4, published 24 September 2026.

Which products and versions are affected?

Kvcache-Ai Mooncake up to 0.3.12, 0.3.13.post1, 0.3.14-rc1.

Is there a fix for CVE-2026-96763?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-96763 attacked?

It is attacked over the network.

Am I affected by CVE-2026-96763?

Check whether you run Kvcache-Ai Mooncake at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-96763: kvcache-ai Mooncake access control bypass in MountSegment

CVE-2026-96763 · Severity: medium · CVSS 5.4 · Published 2026-09-24

Mooncake, a distributed storage system, fails to validate that a client owns the resources it claims during segment registration. An attacker can register a fake storage segment that points to another client's memory and Transfer Engine endpoint, then write arbitrary data to that victim's memory during normal storage operations. This allows cross-client data corruption and integrity violations without requiring access to the victim's systems.

Technologies: Kvcache-Ai Mooncake. Vendors: Kvcache-Ai.

Quick answers

Is CVE-2026-96763 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-96763 being exploited in the wild.
How severe is CVE-2026-96763?: Medium severity, with a CVSS score of 5.4, published 24 September 2026.
Which products and versions are affected?: Kvcache-Ai Mooncake up to 0.3.12, 0.3.13.post1, 0.3.14-rc1.
Is there a fix for CVE-2026-96763?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-96763 attacked?: It is attacked over the network.
Am I affected by CVE-2026-96763?: Check whether you run Kvcache-Ai Mooncake at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is in ScopedSegmentAccess::MountSegment (segment.cpp) which does not verify that the Transfer Engine endpoint and memory address range supplied by a client actually belong to that client. An attacker can submit a MountSegment request with a victim's real endpoint and registered memory range, create an allocator from these forged credentials, and then use preferred-segment allocation to write attacker-controlled data to the victim's memory via the Transfer Engine data plane. The attack requires network access to the Mooncake Store Master but no authentication or victim interaction.

Affected products

kvcache-ai Mooncake up to 0.3.12, 0.3.13.post1, 0.3.14-rc1

Timeline

2026-09-24: disclosed: CVE-2026-96763 published
2026-07-24: other: Proof of concept released on GitHub

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.