CVE-2026-80233: CAYIN Technology｜CAYIN CMS-WS/CMS-SE/SMP - Arbitrary File Upload

Published Aug 26, 2026

Updated

CAYIN CMS-WS, CMS-SE, and SMP series products developed by CAYIN Technology have an Arbitrary File Upload vulnerability. Privileged remote attackers can upload and execute web shells backdoors, thereby enabling arbitrary code execution on the server.

Affected Software

3 affected components

CAYIN Technology CAYIN CMS-WS

CAYIN Technology CAYIN CMS-SE

CAYIN Technology CAYIN SMP series products

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade CAYIN CMS-SE to a version that resolves this vulnerability.
Fixed in 11.0.26198
Upgrade
Upgrade CAYIN CMS-WS to a version that resolves this vulnerability.
Fixed in 1.0.26198
Upgrade
Upgrade CAYIN SMP to a version that resolves this vulnerability.
Fixed in 4.0.26198

Event History

Aug 26, 2026

CVE Published

via MITRE·08:19 AM

Data Sourced

via MITRE·08:19 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker must be remote and already hold privileged access to the affected CAYIN CMS-WS, CMS-SE, or SMP product. No user interaction is required.

What is the impact of successful exploitation?

A privileged attacker can upload and execute a web-shell backdoor, resulting in arbitrary code execution on the server. The listed impact includes high confidentiality, integrity, and availability effects.

Are default deployments known to be affected?

The available information identifies affected product families but does not state whether the vulnerable upload functionality is enabled or reachable in default configurations.