CVE-2026-37637 is a critical remote code execution vulnerability in Alexantr filemanager v1.0, specifically within the filemanager.php component. The vulnerability allows an attacker with network access and no privileges or user interaction to execute arbitrary code remotely. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) indicates the attack can be performed remotely with low complexity, no privileges, and no user interaction, resulting in high confidentiality and integrity impact without affecting availability. No patch or remediation level has been published yet, and no exploits are currently known in the wild.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary code on the server running Alexantr filemanager v1.0. This could lead to full compromise of the affected system's confidentiality and integrity. Availability is not impacted according to the CVSS vector. The vulnerability represents a critical risk due to the ease of exploitation and the potential damage.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict network access to the filemanager.php component, apply network-level controls, or disable the vulnerable component if possible. Monitor vendor channels for updates and patches addressing this vulnerability.