CVE-2024-26477: n/a
Source CVE Database V5
Not known to be exploited · CVSS 7.5 High.
Data as of 26 Oct 2026, 06:26 UTC
- EPSS
- 0.5% chance of exploitation in 30 days – higher than 47% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 11 Feb 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.
What to do
AI-suggested
To mitigate CVE-2024-26477, organizations should first verify if they are running Statping-ng version 0.91.0 or earlier. Immediate steps include restricting external access to the vulnerable API endpoints by implementing network-level controls such as firewall rules or API gateways that enforce strict authentication and authorization. If patching is not yet available, consider disabling or limiting the use of the oauth, amazon_sns, and export endpoints temporarily. Employ monitoring and logging to detect unusual or unauthorized API requests targeting these endpoints. Additionally, review and rotate any credentials or tokens that may have been exposed due to this vulnerability. Engage with the Statping-ng development community or vendor for updates and patches, and apply them promptly once released.
Description
An issue in Statping-ng v.0.91.0 allows an attacker to obtain sensitive information via a crafted request to the api parameter of the oauth, amazon_sns, export endpoints.