CVE-2026-49113
HighCVSS 8.5Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
In Cornerstone versions below 7.8.8, there is a vulnerability allowing arbitrary code execution by a subscriber.
Risk Assessment
An attacker could exploit this vulnerability to execute malicious code, potentially leading to serious security breaches in the system.
Recommendation
It is recommended to upgrade to version 7.8.8 or later to mitigate this vulnerability.
Other vulnerabilities in Cornerstone
See all- CVE-2026-54185High
Subscriber SQL Injection vulnerability in Cornerstone versions below 7.8.8 allows attackers to execute malicious SQL queries.
- CVE-2025-63072Medium
Stored XSS vulnerability in Cornerstone plugin by THEMECO. Improper input neutralization during web page generation allows persistent script injection.
Original NVD description (English source)
Subscriber Arbitrary Code Execution in Cornerstone < 7.8.8 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS