Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-86272

CVE-2026-86272MEDIUM

Beijing Meite Software Technology U+Smart Enjoyment WebSite UploadFormImg.ashx unrestricted upload

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0051   41.7     —

AFFECTED
  Product                    Versions             Fixed
  U+Smart Enjoyment WebSite  18.6001.1096.1000 –  —

TIMELINE
  Sep 6   Reserved by VulDB
  Sep 7   Published (CNA: VulDB)
  Sep 8   EXPLOIT PUBLISHED — CVE-2026-86272 (Beijing Meite Software Technology U+Smart Enjoyment WebSite). Public exploit reference added.

CWE-284, CWE-434 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred

Description

A vulnerability was determined in Beijing Meite Software Technology U+Smart Enjoyment WebSite 18.6001.1096.1000. This impacts an unknown function of the file /Report/Upload/UploadFormImg.ashx. Executing a manipulation of the argument File can lead to unrestricted upload. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
September 6, 2026	Reserved	Reserved by VulDB
September 7, 2026	Published	Published (CNA: VulDB)
September 8, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-86272 (Beijing Meite Software Technology U+Smart Enjoyment WebSite). Public exploit reference added.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Beijing Meite Software Technology	U+Smart Enjoyment WebSite	—	18.6001.1096.1000	—

Weaknesses

CWE-284 · CWE-434

References (5)

Authoritative record: CVE-2026-86272 at cve.org

Vendors: beijing meite software technology

Weaknesses: CWE-284 · CWE-434

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-86272 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.