Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

AltumCode 66Uptime could let attackers run code

CVE-2026-39117 · published 19 days ago
Summary

The main AltumCode 66Uptime product and its ping-servers plugin let a remote attacker run any code on the server through the index.php page. This could let an attacker take control of the web server or steal data. Update both the core product to version 54.0.0 or later and the ping-servers plugin to version 2.0.0 or later to close the risk.

Original advisory text
An issue in AltumCode 66Uptime before v.54.0.0 and 66Uptime ping-servers plugin before v.2.0.0 allows a remote attacker to execute arbitrary code via the index.php
An issue in AltumCode 66Uptime before v.54.0.0 and 66Uptime ping-servers plugin before v.2.0.0 allows a remote attacker to execute arbitrary code via the index.php
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-94Code Injection
Timeline
Published29 Sep 2026
Updated19 Oct 2026
First seen29 Sep 2026
Sources
CVE-2026-39117 · NVD
CVE-2026-39117 · MITRE
Track software like this
Free during beta