Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-107824— x64dbg-MCP Server exposes debugger operations to unauthenticated network clients

Quick assessment

Affected
duty1g x64dbg-mcp-server
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

x64dbg-MCP Server 是一个原生的 Model Context Protocol（MCP）插件，用于 x64dbg，它通过 HTTP 暴露调试器的全部功能。在 1.1 版本之前，x64dbg-MCP Server 会在默认监听 0.0.0.0 的情况下，通过 HTTP 和 SSE 暴露所有 MCP 调试工具，而无需进行身份验证。任何能够访问默认端口（x64 为 9094，x32 为 9095）且未经身份验证的网络客户端，都可以执行任意的 x64dbg 命令、按进程 ID 附加到进程、读取和写入调试目标

CVSS 9.3 · Critical

Affected Version Matrix 1

VendorProduct Version RangeStatus
duty1g x64dbg-mcp-server < 1.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-107824

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
x64dbg-MCP Server exposes debugger operations to unauthenticated network clients
Source: CVE Program / CVE List V5
Vulnerability Description
x64dbg-MCP Server is a native Model Context Protocol (MCP) plugin for x64dbg that exposes the debugger's full functionality over HTTP. Prior to 1.1, x64dbg-MCP Server exposes all MCP debugger tools over HTTP and SSE without authentication while listening on 0.0.0.0 by default. Any unauthenticated network client that can reach the default port, 9094 for x64 or 9095 for x32, can execute arbitrary x64dbg commands, attach to processes by PID, read and write debuggee memory, and write files to arbitrary paths. This issue is fixed in version 1.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
duty1g x64dbg-mcp-server < 1.1 -

II. Public POCs for CVE-2026-107824

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-107824

请登录查看更多情报信息。

Other References for CVE-2026-107824 (6)

IV. Related Vulnerabilities

Same product: x64dbg-mcp-server
Same vendor: duty1g
Same weakness: CWE-306

V. Comments for CVE-2026-107824

No comments yet

Leave a comment