CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

PHP SOAP extension UAF in SOAP_GLOBAL(ref_map) (with companions CVE-2026-7261, CVE-2026-7262); patched in PHP 8.4.8 / 8.3.22 / 8.2.30

cve · CVE-2026-6722

Coverage
1
first 2026-05-11 → last 2026-10-21
Latest activity
2026-05-11
A crafted SOAP envelope can make PHP reuse a freed object; PHP fixed it with two narrower SOAP flaws on…
Peak priority
routine
1 routine
Targets
·
no sector or region stated
Sources cited
7
4 hosts

Defender insights

What each entry about CVE-2026-6722 tells a defender to do, newest first.

Story timeline

  1. 2026-05-11CVE-2026-6722: PHP SOAP extension use-after-free in the ref_map deduplication can lead to code execution, fixed in PHP 8.2.31 to 8.5.6
    trending-vulnerabilitiesA crafted SOAP envelope can make PHP reuse a freed object; PHP fixed it with two narrower SOAP flaws on 2026-05-07

Hunting pivots

Affected products
PHP
Tags
patch-availablepre-authrcevulnerabilities
ATT&CK techniques (1 across 1 tactic)

1 technique observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-05-11/cve-2026-6722-php-soap-use-after-free-in-soap-global-ref-map · ATT&CK page ↗

Entries about PHP SOAP extension UAF in SOAP_GLOBAL(ref_map) (with companions CVE-2026-7261, CVE-2026-7262); patched in PHP 8.4.8 / 8.3.22 / 8.2.30 (1)

2026-05-11 · view entry permalink →

ROUTINECVE-2026-6722 +2updatedNATOA2

CVE-2026-6722: PHP SOAP extension use-after-free in the ref_map deduplication can lead to code execution, fixed in PHP 8.2.31 to 8.5.6

PHP 8.2.31, 8.3.31, 8.4.21 and 8.5.6, released on 2026-05-07, fix three flaws in the SOAP extension (php.watch, 2026-05-07) (PHP 8 ChangeLog). The serious one, CVE-2026-6722, is a use-after-free: ext-soap remembers decoded PHP objects in SOAP_GLOBAL(ref_map) for id/href deduplication without holding a reference, so an apache:Map with a duplicate key and an empty value frees an object while the map still points to it, and a later href reuses the freed memory, which PHP's advisory says can lead to remote code execution (PHP, GHSA-85c2-q967-79q5). The advisory includes a reproducer (PHP, GHSA-85c2-q967-79q5). PHP rates it High in that advisory, and the CVE record PHP published as the numbering authority scores it 9.5 under CVSS 4.0, with high attack complexity and attack requirements present (ENISA EUVD, EUVD-2026-28966).

The two companion flaws are narrower. CVE-2026-7261 is a use-after-free when a header handler returns false or throws while the server uses SOAP_PERSISTENCE_SESSION (PHP, GHSA-m33r-qmcv-p97q); CVE-2026-7262 is a NULL pointer dereference in the apache:Map decoder when the server has a typemap configured, a denial of service that PHP's advisory scores 6.3 under CVSS 4.0 (PHP, GHSA-hmxp-6pc4-f3vv); its CVE record scores 2.9, the same base vector with the threat metric for a public proof of concept added (ENISA EUVD, EUVD-2026-28971). No source reports exploitation.

Correctionrun 2026-10-11T1307Z-audittitleheadlinesummaryevent_dateprioritytechniquesaffected_productscvessourcesclassificationdeep_divedeep_dive_categorybody

CVE-2026-7262 is a NULL pointer dereference that needs a typemap and causes a denial of service (PHP, GHSA-hmxp-6pc4-f3vv), and CVE-2026-7261 is a use-after-free that needs SOAP_PERSISTENCE_SESSION (PHP, GHSA-m33r-qmcv-p97q); neither was shown to give code execution. PHP's own advisory for CVE-2026-6722 includes a reproducer (PHP, GHSA-85c2-q967-79q5). The priority moves from notable to routine: no source reports exploitation, and the fix is a patch-cycle upgrade for PHP hosts.

Improvementrun 2026-10-21T0800Z-auditcvessourcesbody

The CVE record for CVE-2026-7262 scores it 2.9 under CVSS 4.0, against 6.3 in PHP's advisory: the base vector is the same, and the record adds the threat metric for a public proof of concept (ENISA EUVD, EUVD-2026-28971).

vulnerability11 May 05:00Zmulti-sourceOpen finding →
Sources: PHP · php.watch · ENISA EUVD

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • github.com3 (43%)
  • euvd.enisa.europa.eu2 (29%)
  • php.net1 (14%)
  • php.watch1 (14%)

External references

NVD · cve.org · CISA KEV

All cited sources (7)