CVE-2026-72776

AgenticSeek Unauthenticated RCE via /query API Endpoint

No known exploitation. EPSS puts it in the 66th percentile. Fixed in f1eb2cfc721f8a21dd16a8b048a9ca89f3259f6f.

CVSS 3.19.8Critical EPSS percentile66th1.1% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known Fixf1eb2cfc721f8a21dd16a8b048a9ca89f3259f6fUpgrade to this build

Check it yourself

No ready-made check. Neither Nuclei nor OpenVAS has one for this CVE yet.

Request a scan

Published 2026-08-13Updated 2026-09-24Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

Fosowl AgenticSeekAffected: < f1eb2cfc721f8a21dd16a8b048a9ca89f3259f6fUpgrade to: f1eb2cfc721f8a21dd16a8b048a9ca89f3259f6fStated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether you run AgenticSeek and whether its /query API endpoint is reachable from outside your trusted network.
Update AgenticSeek to commit f1eb2cfc721f8a21dd16a8b048a9ca89f3259f6f.
Until it is updated, block public access to the API and disable unrestricted shell execution.
Review the affected server for unexpected commands, new accounts, or unfamiliar running programs.

Usually a quick update

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

AgenticSeek (commit fc242c7) contains an unauthenticated remote code execution vulnerability that allows any network-adjacent attacker to execute arbitrary commands by submitting crafted queries to the unprotected POST /query API endpoint bound to 0.0.0.0:7777 with wildcard CORS. Attackers can send unauthenticated HTTP requests that cause the autonomous agent to generate and execute shell commands through BashInterpreter using subprocess.Popen with shell=True and safety=False, bypassing the incomplete command blocklist to achieve full host-level code execution.

In plain language

Written by AI from the record

AgenticSeek can let an outsider take over its server if its query service is exposed with the default unsafe shell-execution setting, so affected small businesses should act promptly.

Unauthenticated network RCE in AgenticSeek’s /query API allows crafted requests to reach unrestricted shell command execution.

If you're affected

Full server takeover
Customer data exposure
Business system disruption
Ransomware risk

What is it

This is a flaw in AgenticSeek that can allow a stranger to send a request that makes the server run commands for them. It is like leaving a service entrance unlocked and allowing anyone who enters to operate every control in the building.

Who is affected

This matters to you if you run AgenticSeek, especially on a server that handles business data or connects to other internal systems. It is a risk only when the vulnerable API endpoint is reachable over the network and the default insecure shell-execution setting is enabled.

How urgent is it

Treat this as an amber-priority issue because a network attacker can take over a reachable server by sending a crafted request. No confirmed real-world exploitation or public exploit code is recorded, but exposure should be removed while you schedule the update.

What to do — in detail

Confirm exposure by identifying AgenticSeek deployments, checking whether /query is bound or routed to a network reachable by untrusted users, and verifying whether unrestricted shell execution remains enabled. Upgrade to commit f1eb2cfc721f8a21dd16a8b048a9ca89f3259f6f; no separate fixed release branches were provided. If upgrading is delayed, restrict the endpoint to trusted internal clients or disable shell execution, then review host and application logs for unexpected query requests, spawned commands, processes, accounts, or network connections. CISA has not added this CVE to the Known Exploited Vulnerabilities catalog, so there is no CISA remediation due date.

Technical context

CVE-2026-72776 is rated Critical (CVSS 9.8) and is CWE-306, missing authentication. A network attacker requires no authentication or user interaction when the exposed /query endpoint is reachable under the default insecure configuration, enabling arbitrary host-level command execution through unrestricted shell access. It is not listed in CISA KEV and no public exploit code is on record. EPSS predicts a 0.8% likelihood of exploitation (56th percentile), with a flat trend; this is predictive, not evidence of exploitation.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS66th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

1.1% chance of exploitation activity in the next 30 days, which ranks it in the 66th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

7 events over 42 days, from the signal feeds we watch.

2026-09-24Record updated
2026-08-18Record updated
2026-08-14Record updated
2026-08-13Publishedweakness classified, att&ck mapped, record updated

Affected products

Fosowl
- AgenticSeekMixedAI / ML / ai-agent-tooling

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable

Weaknesses

CWE-306No name in the record

ATT&CK techniques

Mapped from the weaknesses above (CWE to ATT&CK), not observed in attacks.

Initial AccessT1078Valid Accountshigh confidence T1190Exploit Public-Facing Applicationhigh confidence

Sources

References in the record

And 1 more reference. See all after sign-in

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for AgenticSeek, not every advisory.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account