CVE-2026-77647 -- CVSS 9.8 Vulnerability Briefing

CVE-2026-77647 | CVSS 9.8 (Critical) | Exploit: PoC available

What Is It

CVE-2026-77647 is an unauthenticated remote code execution vulnerability affecting SPIP versions before 4.4.20.

Technical Detail

The flaw involves incorrect identification of PHP opening blocks and unsafe handling of certain input cases by PHP's var_export(), including values containing a < character. An unauthenticated remote attacker may be able to trigger this processing flaw to cause arbitrary PHP code execution on the SPIP server. Successful exploitation can result in full compromise of the affected application and, depending on the server configuration, the underlying host.

Exploitation Status

A public proof of concept is available. The vulnerability description reports exploitation in the wild during August 2026, although CVE-2026-77647 is not listed in CISA's Known Exploited Vulnerabilities catalog as of August 21, 2026.

Who Is Targeting This

No specific threat actor attribution at this time.

What To Do

Upgrade SPIP to version 4.4.20 or later as an urgent priority, especially for internet-accessible instances. Until patching is complete, restrict access to SPIP administrative and application endpoints to trusted networks where operationally feasible, and monitor web server and application logs for unusual requests associated with SPIP processing errors or unexpected PHP execution. Review affected servers for unauthorized PHP files, altered application content, unexpected scheduled tasks, and suspicious outbound network connections. No vendor-supported workaround or specific indicators of compromise are confirmed in the available data.