Key points
- CVE-2026-107824 carries a CVSS score of 9.3, rated as critical severity by the National Vulnerability Database.
- The vulnerability affects x64dbg-MCP Server versions prior to 1.1, where authentication is missing on default ports.
- Attackers can read and write memory, attach to processes, and write files to arbitrary paths without credentials.
The National Vulnerability Database recorded CVE-2026-107824 as a critical security flaw in the x64dbg-MCP Server plugin. This vulnerability allows unauthenticated remote attackers to execute arbitrary commands on systems running versions prior to 1.1. The issue stems from the server exposing debugger tools over HTTP without requiring any form of authentication.
According to the NVD record, the x64dbg-MCP Server listens on 0.0.0.0 by default, making it accessible to any network client. Attackers reaching the default port 9094 for x64 systems or 9095 for x32 systems can exploit this gap. They can execute arbitrary x64dbg commands, attach to running processes by their PID, and read or write debuggee memory.
Context and Background
The x64dbg-MCP Server functions as a native Model Context Protocol plugin for the x64dbg debugger. It exposes the debugger's full functionality over HTTP and Server-Sent Events (SSE). The National Vulnerability Database categorizes this weakness under CWE-306, which relates to incorrect default permissions. The lack of authentication on these exposed endpoints creates a significant attack surface for remote exploitation.
Who Is Affected
Organizations using x64dbg for software development or reverse engineering are at risk if they utilize the MCP Server plugin. Specifically, any deployment running x64dbg-mcp-server versions older than 1.1 is vulnerable. Developers who have enabled this plugin on build servers or shared development environments face the highest exposure, as the service binds to all network interfaces by default.
Next steps
The vendor has released version 1.1 to address this critical vulnerability. Users should verify their current installation version immediately. If the system is running a version prior to 1.1, upgrading to the patched version is necessary to restore proper authentication controls. Until the update is applied, the service remains open to unauthenticated remote code execution attacks.
What to do and how to stay safe: x64dbg
- Audit network configurations to ensure the x64dbg-MCP Server ports 9094 and 9095 are not accessible from untrusted networks.
- Verify the current version of the x64dbg-MCP Server plugin and upgrade to version 1.1 or later once available.
- Monitor network traffic for unusual connections to the default ports that may indicate exploitation attempts.
- Restrict firewall rules to block external access to these specific ports unless strictly required for internal operations.
Step-by-step guide: Emergency Patching Checklist for Critical System Fixes
General security guidance from the SecOps Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the severity of CVE-2026-107824?
The National Vulnerability Database rates CVE-2026-107824 as critical with a CVSS score of 9.3.
Which versions of x64dbg-MCP Server are affected?
All versions of the x64dbg-MCP Server prior to version 1.1 are affected by this vulnerability.
Is there a fix available for this issue?
Yes, the issue is fixed in version 1.1 of the x64dbg-MCP Server plugin.
