CVE-2026-58736
A NVD · · CVE-2026-58736
Admiralty grading (A–F · 1–6)
Source reliability
- A Completely reliable
- B Usually reliable
- C Fairly reliable
- D Not usually reliable
- E Unreliable
- F Cannot be judged
Information credibility
- 1 Confirmed
- 2 Probably true
- 3 Possibly true
- 4 Doubtful
- 5 Improbable
- 6 Cannot be judged
NATO Admiralty (AJP-2.1) grades confidence, independent of the risk score. Cross-source corroboration isn't tracked for non-CVE news, so single-source items are capped at a lower credibility number; a low number does not imply low quality.
Key metrics
- EPSS
- 0%
Key insight
The vulnerability allows remote privilege escalation without user interaction via a use-after-free condition in SIP response handling; active exploitation is not evidenced.
Description
CVE-2026-58736 describes a use-after-free vulnerability in the SIP response handling of SessionEx.cpp: a dangling connection pointer in the pending response queue can corrupt memory. According to the description, this can be exploited for remote privilege escalation without additional execution privileges or user interaction. The affected component is the SIP stack of 3CX Phone System. The NVD entry does not mention active exploitation, KEV status, or a public proof-of-concept.
Risk score
- cvss base
- 0.00
- kev bonus
- 0.00
- epss bonus
- 0.00
- poc bonus
- 0.00
- raw before weight
- 0.00
- industry weight
- 1.21
- freshness factor
- 1.00
- exploitability factor
- 1.00
- days old
- 0.00
- vendor mismatch penalty
- 0.00
Path: operational