CVE-2026-28800
Last modified
CVE-2026-28800 is a high-severity vulnerability rated 8/10 on the CVSS scale. Natro Macro is an open-source Bee Swarm Simulator macro written in AutoHotkey. Prior to version 1.1.0, anyone with Discord Remote Control set up in a non-private channel gives access to any user with the permission to send message in said channel access to do anything on their computer. EPSS estimates a 0.21% chance of exploitation in the next 30 days.
Description
Natro Macro is an open-source Bee Swarm Simulator macro written in AutoHotkey. Prior to version 1.1.0, anyone with Discord Remote Control set up in a non-private channel gives access to any user with the permission to send message in said channel access to do anything on their computer. This includes keyboard and mouse inputs and full file access. This issue has been patched in version 1.1.0.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Natroteam | Natro Macro | < 1.1.0 |
References
- https://github.com/NatroTeam/NatroMacro/security/advisories/GHSA-ph9r-2qjm-ghvgMitigation, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-28800?
How severe is CVE-2026-28800?
How do I fix CVE-2026-28800?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-28794oRPC is an tool that helps build APIs that are end-to-end ty…9.8
- CVE-2026-28795OpenChatBI is an intelligent chat-based BI tool powered by l…9.8
- CVE-2026-28797RAGFlow is an open-source RAG (Retrieval-Augmented Generatio…8.8
- CVE-2026-28798ZimaOS is a fork of CasaOS, an operating system for Zima dev…10
- CVE-2026-28799PJSIP is a free and open source multimedia communication lib…7.5
- CVE-2026-2880A vulnerability in @fastify/middie versions < 9.2.0 can resu…9.1
- CVE-2026-28801Natro Macro is an open-source Bee Swarm Simulator macro writ…7.8
- CVE-2026-28802Authlib is a Python library which builds OAuth and OpenID Co…9.8
- CVE-2026-28803Open Forms allows users create and publish smart forms. Prio…6.5
- CVE-2026-28804pypdf is a free and open-source pure-python PDF library. Pri…5.3
- CVE-2026-28805OpenSTAManager is an open source management software for tec…8.8
- CVE-2026-28806Improper Authorization vulnerability in nerves-hub nerves_hu…8.8
Are you affected by CVE-2026-28800?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST