CLAIM-2026-08-24-02

The same CNA scored CVE-2026-75130 at 9.0 Critical under CVSS 3.1 and 6.4 Medium under CVSS 4.0; the CVSS 4.0 vector rates the vulnerable system's own confidentiality, integrity and availability as None (VC:N/VI:N/VA:N) while scoring the subsequent system High (SC:H/SI:H/SA:H).

Why it matters

The split score is the point: the MCP server carries the injection but takes no damage itself, so a severity read that stops at the server misjudges the risk to the developer machine downstream.

Sources

• nvdnistnati2026cve
• vulncheck2026context