CVE-2026-108749

Status: RejectedUnscored—

Severity—Unscored

Exploitation probability0.30 %higher than 21% of CVEs

Active exploitationNonot in the CISA catalog

Public exploitNot knownno public code found

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVSS

NVD hasn't assigned a CVSS score to this CVE (common since the April 2026 policy change).

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 0.30 %
Percentile among all scored CVEs: 21
Score date: 10/16/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

ExploitationT1190 Exploit Public-Facing Applicationinitial access85 %
Primary impactT1078 Valid Accountsstealth · persistence · privilege escalation · initial access75 %
Secondary impactT1005 Data from Local Systemcollection80 %

Vector CVSS:4.0 con AV:N/AC:L/PR:N/UI:N indica acceso remoto sin autenticación ni interacción (T1190). La vulnerabilidad permite bypasear el API_KEY configurado (T1078), accediendo a endpoints que leen telemetría de memoria y estadísticas del proceso (T1005).

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

ATT&CK mitigations that cover these techniques

Privileged Account Management Application Developer Guidance Active Directory Configuration Vulnerability Scanning User Training User Account Management

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Docling Serve — Docling Serve^AI

CWEs

CWE-306

Raw JSON (NVD)

Show

{
  "id": "CVE-2026-108749",
  "cveTags": [],
  "metrics": {},
  "published": "2026-10-11T13:17:19.670",
  "references": [],
  "vulnStatus": "Rejected",
  "descriptions": [
    {
      "lang": "en",
      "value": "Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."
    }
  ],
  "lastModified": "2026-10-18T22:10:00.100",
  "sourceIdentifier": "disclosure@vulncheck.com"
}