High 7.5Published Oct 12, 2026

CVE-2026-109360MONAI 0.4.0 before 1.6.1 RCE via SENet Pretrained Weights Over Plaintext HTTP

Updated under an hour ago (2026-10-19 08:30 UTC)

Does this affect you?

It affects Project-MONAI MONAI. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 0.45%, higher than 38% of scored CVEs.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Project-MONAI MONAI

Exploited in the last 30 days

MONAI 0.4.0 before 1.6.1 contains a remote code execution vulnerability that allows on-path attackers to execute code by tampering with SENet pretrained weights fetched over plaintext HTTP. Attackers can substitute a crafted .pth file that load_state_dict_from_url unpickles without weights_only=True, executing code when SEResNet50 or other SENet models are constructed with pretrained=True.

CVSS: 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-502
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 0.45% (percentile 38)
Assigned by: VulnCheck
NVD analysis: Deferred
Record last updated: Oct 13, 2026
First seen by InfoSec Signals: Oct 12, 2026

Affected products

Affected products

Project-MONAI MONAI project_monai:monai (from the name)	from 0.4.0 before 1.6.1; 1.6.1 not affected	CNA record

References

https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-vm9c-7j6g-c7mmvendor-advisory
https://www.vulncheck.com/advisories/monai-0.4.0-before-1.6.1-rce-via-senet-pretrained-weights-over-plaintext-httpthird-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.