CVE-2026-25856
OpenBullet2 0.3.2 Authenticated RCE via Job Configuration Interface
CVSS Score
8.8
EPSS Score
0.0%
EPSS Percentile
0th
OpenBullet2 through version 0.3.2 contains an authenticated remote code execution vulnerability that allows authenticated users to execute arbitrary C# code on the server host by creating or modifying job configurations. Attackers can leverage the plain C# execution mode, which lacks reference filtering or API restrictions, to access the file system, spawn processes, and invoke arbitrary .NET APIs as the process user.
| CWE | CWE-94 |
| Vendor | openbullet |
| Product | openbullet2 |
| Published | Jun 8, 2026 |
| Last Updated | Jun 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for openbullet openbullet2
Be the first to know when new high vulnerabilities affecting openbullet openbullet2 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
openbullet / openbullet2
0 ≤ 0.3.2
References
Credits
Maksim Rogov VulnCheck