CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Called exploited 19 days after disclosure.
Measured from the CVE publication date to the earliest of 1 KEV catalogue that list it.
The life of this vulnerability
- CVE published
- First KEV listing19d
- Last sighting36d
Gaps are compressed to equal steps. The elapsed time is printed under each.
Which catalogues call it exploited
- CISA KEVUS federaldoes not list it
- EUVDENISA, European Uniondoes not list it
- VulnCheck KEVcommercial researchlisted Jul 21, 2026
- CIRCLaggregator, mirrors the abovedoes not list it
This rests on a single catalogue. No second catalogue corroborates the claim that it is being exploited. CIRCL is an aggregator and is not counted.
Public exploitation evidence
- reported exploitationapi.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2026-5
- reported exploitationapi.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2026-5
- reported exploitationapi.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2026-5
- reported exploitationapi.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2026-5
- reported exploitationapi.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2026-5
- reported exploitationapi.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2026-5
9 public reports collected from VulnCheck and CIRCL, first on Jul 21, 2026. Each links to its original source. We have not verified them.
Description
Dockwatch through 0.6.567 contains an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary shell commands by exploiting a missing exit() after an authentication redirect in loader.php combined with unsanitized input passed to shell_exec() in ajax/compose.php. Attackers can seed the required session flag through the incomplete auth check, then inject arbitrary commands via the composePath POST parameter in the composePull action to achieve full host compromise, facilitated by the standard deployment mounting of the Docker socket.