CVE-2026-3395

This flaw is like leaving a back door in the code that processes “preview” requests. An attacker can send a specially crafted request to make the server run their own code—without needing to log in first. In practice, that can lead to your site being taken over or used to harm other systems you connect to.

This matters if you run MaxSite CMS (CMS / maxsite cms), especially if your site uses the MarkItUp editor and the preview AJAX endpoint is reachable. The findings indicate the attack does not require authentication or user interaction, so if the endpoint can be reached over the network, your exposure can be direct. The exact “reachable in default config” detail is not confirmed here, so the safest assumption is to patch if you are on a vulnerable version.

This is RED because the vulnerability enables unauthenticated remote code execution, and the patch findings indicate sustained press attention for exploitation. Attackers can send requests over the network and execute arbitrary code without any login or user action, so delaying upgrade increases the window for compromise.