CVE-2026-7261

Assessment

Why it matters

EPSS is 0.3%; technical severity is CVSS 6.3.

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when SoapServer is configured with SOAP_PERSISTENCE_SESSION, the handler object is persisted across requests via session storage. However, in the case SOAP requests results in an error, the persistance is handled incorrectly, resulting in freeing the object while keeping a pointer to it, which may lead to use-after-free. This may lead to memory corruption, information disclosure, or process crashes, with confidentiality, integrity, and availability impact on the vulnerable system.

Who should care

• Teams operating PHP
• Vulnerability and exposure management teams
• Security operations teams monitoring exploitation activity

Response plan

What I would do

1. Confirm whether PHP is present in the environment.
2. Identify affected versions and establish whether vulnerable services are exposed or reachable.
3. Vendor advisory from github.com
4. Review relevant security telemetry for evidence of attempted or successful exploitation.
5. Document the remediation decision and track it to verified completion.

Technical details

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:X/RE:M/U:Amber

CWE

CWE-416

Affected versions

PHP PHP (Start Including 8.2.0, End Excluding 8.2.31 | Start Including 8.3.0, End Excluding 8.3.31 | Start Including 8.4.0, End Excluding 8.4.21 | Start Including 8.5.0, End Excluding 8.5.6)

Fixed versions

PHP PHP (Fixed from 8.2.31, 8.3.31, 8.4.21, 8.5.6)

Published

10 May 2026

Attack vector

Network

Privileges required

None

User interaction

None

Signal timeline

1. 10 May 2026CVE published
2. 21 Aug 2026Latest EPSS score: 0.3%
3. 19 Aug 2026 · 13:52 UTCSignal calculated at 10

External references

• GitHub Technical reference GHSA M33r Qmcv P97q ↗