CVE-2026-26201 emp3r0r Affected by Concurrent Map Access DoS (panic/crash)
Concurrent map access without synchronization causes the emp3r0r C2 server to crash, resulting in denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-26201?
CVE-2026-26201 is a high-severity vulnerability in jm33-m0 emp3r0r, published on 19 Feb 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
emp3r0r is a C2 designed by Linux users for Linux environments. Prior to version 3.21.2, multiple shared maps are accessed without consistent synchronization across goroutines. Under concurrent activity, Go runtime can trigger `fatal error: concurrent map read and map write`, causing C2 process crash (availability loss). Version 3.21.2 fixes this issue.
Which versions are affected by CVE-2026-26201?
3 open source packages ship an affected version, including github.com/jm33-m0/emp3r0r/core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/jm33-m0/emp3r0r/core Go | All versions | 0.0.0-20260212232424-ea4d074f081d |
github.com/jm33-m0/emp3r0r/core Go | All versions | 0.0.0-20260212232424-ea4d074f081d |
github.com/jm33-m0/emp3r0r/core Go | All versions | 0.0.0-20260212232424-ea4d074f081d |
Products include Jm33-M0 Emp3r0r.
How do I fix CVE-2026-26201?
Upgrade github.com/jm33-m0/emp3r0r/core to 0.0.0-20260212232424-ea4d074f081d or later.
Is CVE-2026-26201 being exploited?
There is no known exploitation of CVE-2026-26201 in the wild and no public exploit code.
Other vulnerabilities in jm33-m0 emp3r0r
Sources
Also known as GHSA-f5p9-j34q-pwcc, GO-2026-4504.