CVE-2026-7261
Last modified
CVE-2026-7261 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when SoapServer is configured with SOAP_PERSISTENCE_SESSION, the handler object is persisted across requests via session storage. However, in the case SOAP requests results in an error, the persistance is handled incorrectly, resulting in freeing the object while keeping a pointer to it, which may lead to use-after-free. EPSS estimates a 0.30% chance of exploitation in the next 30 days.
Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when SoapServer is configured with SOAP_PERSISTENCE_SESSION, the handler object is persisted across requests via session storage. However, in the case SOAP requests results in an error, the persistance is handled incorrectly, resulting in freeing the object while keeping a pointer to it, which may lead to use-after-free. This may lead to memory corruption, information disclosure, or process crashes, with confidentiality, integrity, and availability impact on the vulnerable system.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:X/RE:M/U:Amber
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Php | Php | >= 8.2.0, < 8.2.31 |
| Php | Php | >= 8.3.0, < 8.3.31 |
| Php | Php | >= 8.4.0, < 8.4.21 |
| Php | Php | >= 8.5.0, < 8.5.6 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-7261?
How severe is CVE-2026-7261?
How do I fix CVE-2026-7261?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-72604A path traversal vulnerability in Intelliants Subrion CMS th…6.5
- CVE-2026-72605A missing authentication vulnerability in Swing Music 3.0.0 …7.5
- CVE-2026-72606A server-side request forgery vulnerability in Pinry through…7.5
- CVE-2026-72607A stored SQL injection vulnerability in Koha through 24.11.1…7.1
- CVE-2026-72608A stored SQL injection vulnerability in Koha through 24.11.1…6.5
- CVE-2026-72609An SQL injection vulnerability in Koha through 24.11.17, 25.…7.1
- CVE-2026-72610A stored SQL injection vulnerability in Koha through 24.11.1…4.3
- CVE-2026-7262In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.…7.5
- CVE-2026-7263In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, …7.5
- CVE-2026-7264A weakness has been identified in SourceCodester Pizzafy Eco…6.3
- CVE-2026-7265A security vulnerability has been detected in SourceCodester…6.3
- CVE-2026-7266A vulnerability was detected in SourceCodester Pizzafy Ecomm…6.3
Are you affected by CVE-2026-7261?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST