CVE-2026-30618 describes a remote code execution vulnerability in xszyou Fay 4.3.1. The vulnerability exists in the MCP STDIO server management and command execution handling, where an attacker can remotely access the exposed MCP management interface without authentication and inject arbitrary commands. This results in execution of attacker-supplied commands on the server running the Fay service, allowing full compromise within that service context. The CVSS v3.1 base score is 9.8, indicating critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No patch or official remediation is currently documented, and no known exploits in the wild have been reported.

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary commands on the affected server with the privileges of the Fay service. This can lead to full compromise of the service, potentially affecting confidentiality, integrity, and availability of the system. The vulnerability is critical due to its remote, unauthenticated nature and high impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the MCP management interface to trusted networks only and monitor for unauthorized access attempts. Avoid exposing the MCP management interface publicly.