CVE-2026-88755

HIGH 7.8

Published 2026-10-16 · Last modified 2026-10-16

Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a repository's workspace configuration, possibly allowing attackers to execute arbitrary code via opening a crafted repository.

ELEVATED IMPACT

Severe if exploited (CVSS 7.8), but no known exploitation and low modeled probability. Patch on a normal cadence.

Exploitation likelihood

0.2%chance of exploitation in 30 days · 11th percentile

○ In CISA KEV ○ Catalogued PoC

Impact if exploited

7.8CVSS 3.1 · HIGH

ConfidentialityHigh
IntegrityHigh
AvailabilityHigh

What an attacker needs

⚠Access: Requires local access to the host
✓Privileges: No account or privileges required
⚠User interaction: A user must take an action (click / open a file)
✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot: 2026-10-26T13:52:32.101Z

Affected

CPE data not yet published (analysis pending).

Weakness (CWE)

CWE-284: Improper Access Control
CWE-863: Incorrect Authorization
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References and research data (JSON)

All CVSS metrics

HIGH 7.8 v3.1 · ADP Primary
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
HIGH 7.8 v3.1 · NVD Secondary
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

Exploit-tagged references (not proof of a PoC)

https://github.com/lkloliver/poc/tree/main/CVE-2026-88755 exploitCVE record · CISA-ADP · Updated 2026-10-16T19:06:26.428Z
NVD · CVE-2026-88755 · Updated 2026-10-16T20:18:12.557

Advisories

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-102905 ADVISORYEUVD · EUVD-2026-102905

Technical & other

http://zai.com/CVE record · mitre · Updated 2026-10-16T14:52:24.845Z
NVD · CVE-2026-88755 · Updated 2026-10-16T20:18:12.557
http://zcode.com/CVE record · mitre · Updated 2026-10-16T14:52:24.845Z
NVD · CVE-2026-88755 · Updated 2026-10-16T20:18:12.557
https://gist.github.com/lkloliver/aac8dcf8a53fc4b3c1b0a5dfbf36ef68CVE record · mitre · Updated 2026-10-16T14:52:24.845Z
NVD · CVE-2026-88755 · Updated 2026-10-16T20:18:12.557

Sources: NVD · CVE.org · EPSS