Remote Code Execution in MONAI Product by Project MONAI
CVE-2026-109360

7.7HIGH

Key Information:

Vendor

Project-monai

Status
Monai
Vendor
CVE Published:
12 October 2026

What is CVE-2026-109360?

A remote code execution vulnerability exists in MONAI version 0.4.0 prior to 1.6.1, allowing attackers to execute arbitrary code. This occurs due to the insecure fetching of SENet pretrained weights over unencrypted HTTP connections. By intercepting these requests, an attacker can substitute malicious .pth files, which are then unpickled without the expected security constraints when constructing SEResNet50 or other SENet models with pretrained=True. Users are urged to update to the latest version to mitigate this risk.

Affected Version(s)

MONAI 0.4.0 < 1.6.1

MONAI 1.6.1

References

https://github.com/Project-MONAI/MONAI/security/advisorie...
vendor-advisory
https://www.vulncheck.com/advisories/monai-0.4.0-before-1...
third-party-advisory

CVSS V4

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

manus-use
.