CVE-2026-109360
Received Received - Intake

Remote Code Execution in MONAI via SENet Pretrained Weights

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
MONAI 0.4.0 before 1.6.1 contains a remote code execution vulnerability that allows on-path attackers to execute code by tampering with SENet pretrained weights fetched over plaintext HTTP. Attackers can substitute a crafted .pth file that load_state_dict_from_url unpickles without weights_only=True, executing code when SEResNet50 or other SENet models are constructed with pretrained=True.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109360
EUVD
EUVD-2026-97662

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Project-MONAI MONAI 0.4.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

MONAI 0.4.0 before 1.6.1 has a remote code execution flaw. Attackers can exploit it by intercepting and replacing SENet pretrained weights downloaded over unencrypted HTTP. The crafted .pth file is unpickled without safety checks, allowing arbitrary code execution when models like SEResNet50 are loaded with pretrained=True.

Detection Guidance

Detecting this vulnerability requires checking for insecure HTTP requests to fetch .pth files in MONAI projects. Monitor network traffic for plaintext HTTP downloads of pretrained weights, especially for SENet models. Inspect code for load_state_dict_from_url calls without weights_only=True.

Impact Analysis

If you use MONAI versions before 1.6.1, attackers could execute malicious code on your system by intercepting model downloads. This could lead to data breaches, system compromise, or unauthorized access to sensitive information.

Compliance Impact

This vulnerability could violate GDPR or HIPAA by enabling unauthorized data access or exfiltration. Compliance requires ensuring secure model downloads and preventing code execution, which this flaw undermines.

Mitigation Strategies

Upgrade MONAI to version 1.6.1 or later. Ensure all load_state_dict_from_url calls include weights_only=True. Replace HTTP with HTTPS for fetching pretrained weights. Validate .pth files before use.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109360. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart