MediaWiki External Data CVE-2026-100382 (CVSS 10) Unauthenticated RCE Exploited in the Wild, PoC Public
ID: aa5ae24f-73f8-52f4-85af-aefe700ee968
STIX ID: report--aa5ae24f-73f8-52f4-85af-aefe700ee968
Feed Name: securityonline.info
Threat Score
Attackers are actively exploiting CVE-2026-100382, a critical (CVSS 10.0) unauthenticated RCE in the MediaWiki External Data extension (versions < 3.7). Public proof-of-concept code is available and automated bots have been observed creating web shells (e.g., PHP files named Nx_*.php) after POST bursts to api.php; operators should upgrade to External Data 3.7 or disable the extension immediately and hunt/rotate secrets.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.