CVE-2026-94389

Unauthenticated Remote Code Execution (RCE) in AcyMailing SMTP Newsletter <= 11.0.5 versions.

  • Published Sep 30, 2026
  • CVSS 9.0 critical
  • 0.5% chance of exploitation in the next 30 days (EPSS)

Affected software

CVE-2026-94389 at the National Vulnerability Database