Vulnerability · Published Aug 19, 2026 · Assigned by VulnCheck

CVE-2026-63722ICEcoder 8.1 Unauthenticated RCE via terminal-xhr.php

Critical 9.8

In plain English

A critical-severity missing authentication in ICEcoder from ICEcoder. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)1.3%top 28.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

ICEcoder 8.1 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by chaining an authentication bypass, CSRF validation bypass, and unsanitized command execution. Attackers can send a single HTTP POST request to the terminal endpoint with a password parameter to bypass authentication, a non-empty csrf parameter to skip CSRF validation, and an arbitrary command string passed directly to proc_open() to achieve remote code execution as the web-server user.

Affected products (as reported)

Vendor	Product	Versions
ICEcoder	ICEcoder	0 – through 8.1

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Product Repository product
https://www.vulncheck.com/advisories/icecoder-unauthenticated-rce-via-terminal-xhr-php third-party-advisory
https://gist.github.com/axg11/fc2b86648d8f385b51f4576ff0f392d8 technical-description