CVE WatchJul 15, 2026

CVE-2026-41603

Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Use

CVSS

7.4

High

EPSS

0.6%

p43

KEV

—

Exploit Today

0-100

Published: Apr 28, 2026 · Last modified: Jul 15, 2026 · CWE-297 · CWE-306 · CWE-295

EPSS · 30d

0.6%EPSS · 30 days0.6%

2026-06-302026-07-17

Technical description

Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2025-32489.8 CRI

100.0%

KEV—80Langflow Missing Authentication Vulnerability3d CVE-2024-116809.8 CRI

99.8%

KEV—80ProjectSend Improper Authentication Vulnerability3d CVE-2026-561645.3 MED

92.0%

KEV—78Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability3d CVE-2026-468179.8 CRI

60.3%

KEV—68Oracle E-Business Suite Improper Privilege Management Vulnerability2d CVE-2023-278239.8 CRI

98.9%

——30An authentication bypass in Optoma 1080PSTX C02 allows an attacker to access the administration console without valid credentials.9d CVE-2022-245629.8 CRI

98.9%

——30In IOBit IOTransfer 4.3.1.1561, an unauthenticated attacker can send GET and POST requests to Airserv and gain arbitrary read/write access to the entire file-system (with admin privileges) on the victim's endpoint, which can result in data theft and remote code execution.9d