CVE-2026-86732 is a remote code execution vulnerability in Craft CMS affecting versions prior to 5.10.12. The flaw exists in the element-index endpoint where authenticated content editors can instantiate arbitrary classes through the criteria parameter. Specifically, attackers inject a malicious class via criteria[withTransforms][0][class], which is processed by ImageTransforms::normalizeTransform(). This enables a PHP gadget chain using yii\rbac\PhpManager to execute arbitrary code by referencing a request log file containing a PHP payload in the User-Agent header.

Successful exploitation allows authenticated content editors to execute arbitrary PHP code on the server, potentially leading to full system compromise. The vulnerability requires authentication with content editor privileges but does not require user interaction beyond that. The CVSS 4.0 score is 8.7 (high severity), reflecting the network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch link is provided in the available data. Until a patch is available, restrict content editor privileges and monitor for suspicious activity related to the element-index endpoint and criteria parameter usage.