Is CVE-2026-109360 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-109360?

CVE-2026-109360 has a CVSS v3 severity of HIGH (7.5).

Back

CVE-2026-109360

Description

MONAI 0.4.0 before 1.6.1 contains a remote code execution vulnerability that allows on-path attackers to execute code by tampering with SENet pretrained weights fetched over plaintext HTTP. Attackers can substitute a crafted .pth file that load_state_dict_from_url unpickles without weights_only=True, executing code when SEResNet50 or other SENet models are constructed with pretrained=True.