CVE-2026-109437

{
  "etk_id": "ETK-2026-2107",
  "cve_id": "CVE-2026-109437",
  "display_id": "CVE-2026-109437",
  "ghsa_id": "GHSA-c2qr-crjw-844g",
  "euvd_id": "EUVD-2026-104570",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated code execution in CognicellAI Cognition",
  "summary": "CognicellAI Cognition versions before 0.13.0 are affected by unauthenticated remote code execution. An attacker able to reach the service can cause commands to run with the server process's privileges when the REST/SSE interface is unauthenticated and the local execution backend is in use.",
  "mitigation": "Upgrade Cognition to version 0.13.0 or later. Until upgraded, restrict network access to the service and require authentication for its exposed interfaces.",
  "vendor": "CognicellAI",
  "product": "Cognition",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 0.13.0"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "0.13.0"
      ],
      "package_name": "Cognition",
      "purl": null
    }
  ],
  "cwes": [
    1188
  ],
  "cvss_score": 9.2,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
  "epss_score": 0.0061,
  "epss_percentile": 0.4816,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 15.728417433333334,
  "t0_at": "2026-10-19T18:22:57.431000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-20T01:25:11.201048+00:00",
      "days": 0.29321493111111113,
      "is_lower_bound": false,
      "measured_at": "2026-10-19T18:22:57.431000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-19T18:22:57.431000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-19T18:22:57.431000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109437"
    }
  }
}