CVE-2026-63722
Received Received - Intake

Unauthenticated Remote Code Execution in ICEcoder 8.1

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: VulnCheck

Description
ICEcoder 8.1 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by chaining an authentication bypass, CSRF validation bypass, and unsanitized command execution. Attackers can send a single HTTP POST request to the terminal endpoint with a password parameter to bypass authentication, a non-empty csrf parameter to skip CSRF validation, and an arbitrary command string passed directly to proc_open() to achieve remote code execution as the web-server user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-20
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-63722
EUVD
EUVD-2026-62698

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
icecoder icecoder 8.1
icecoder icecoder to 8.1 (exc)
icecoder icecoder From 8.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ICEcoder 8.1 has an unauthenticated remote code execution flaw. Attackers can bypass authentication by sending a POST request with a password parameter, skip CSRF validation with a non-empty csrf parameter, and execute arbitrary OS commands via proc_open() without sanitization.

Detection Guidance

Check for unauthorized access to the ICEcoder terminal endpoint by monitoring HTTP POST requests to /terminal with parameters like password and csrf. Look for unexpected command execution attempts in server logs or network traffic.

Impact Analysis

An attacker could gain full control over the server running ICEcoder 8.1, execute malicious commands, steal data, install malware, or disrupt services. This could lead to data breaches, unauthorized access, or system compromise.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR (data protection) and HIPAA (health data privacy). Organizations may face fines, legal penalties, and reputational damage due to non-compliance.

Mitigation Strategies

Upgrade ICEcoder to a patched version if available. Restrict access to the terminal endpoint via firewall rules. Disable unauthenticated access and implement strict input validation for all parameters.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63722. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart