PT-2026-109276 · X64Dbg · X64Dbg-Mcp-Server
CVE-2026-107824
·
Published
2026-10-09
·
Updated
2026-10-09
CVSS v4.0
9.3
Critical
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
x64dbg-MCP Server versions prior to 1.1
Description
x64dbg-MCP Server is a native Model Context Protocol (MCP) plugin for x64dbg that exposes debugger functionality over HTTP and Server-Sent Events (SSE). The server listens on 0.0.0.0 by default without authentication. An unauthenticated network client accessing the default ports (9094 for x64 or 9095 for x32) can execute arbitrary x64dbg commands, attach to processes using the
PID variable, read and write debuggee memory, and write files to arbitrary paths.Recommendations
Update to version 1.1.
Exploit
Fix
Missing Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
X64Dbg-Mcp-Server