CVE-2026-30618

Deferred Deferred - Pending Action

Remote Code Execution in Fay MCP STDIO Server

Publication date: 2026-07-15

Last updated on: 2026-07-16

Assigner: MITRE

Description

xszyou Fay 4.3.1 contains a remote code execution vulnerability in its MCP STDIO server management and command execution handling. A remote attacker can access the publicly exposed MCP management interface and configure an MCP STDIO server with attacker-controlled commands and parameters, resulting in execution of arbitrary commands on the server. Successful exploitation allows arbitrary command execution within the context of the Fay service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-16

Generated

2026-08-05

AI Q&A

2026-07-16

EPSS Evaluated

2026-08-03

NVD

CVE-2026-30618

EUVD

EUVD-2026-44845

Affected Vendors & Products

Vendor	Product	Version / Range
xszyou	fay	4.3.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This vulnerability is a remote code execution flaw in xszyou Fay version 4.3.1. It exists in the MCP STDIO server management and command execution handling. An attacker can exploit it by accessing the publicly exposed MCP management interface and configuring a server with malicious commands, leading to arbitrary code execution on the affected system.

Detection Guidance

To detect this vulnerability, check if the xszyou Fay 4.3.1 service is running and if its MCP STDIO server management interface is exposed to the network. Look for open ports typically associated with MCP services. Inspect running processes for Fay-related services and verify if the interface is accessible externally.

Impact Analysis

This vulnerability allows an attacker to execute arbitrary commands on your server. If exploited, it could lead to unauthorized access, data theft, system compromise, or further network infiltration. The impact depends on the server's permissions and the commands executed.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating compliance requirements under GDPR, HIPAA, and other regulations. It may result in legal penalties, loss of certification, and reputational damage due to compromised data integrity and confidentiality.

Mitigation Strategies

Immediately update xszyou Fay to the latest version if available. If not, disable the MCP STDIO server management interface or restrict network access to it using firewalls. Ensure the service is not exposed to untrusted networks and monitor for unauthorized command execution attempts.

Hi! I’m here to help you understand CVE-2026-30618. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70