CVE-2026-109360: MONAI: unsafe unpickle of SENet weights enables RCE

HIGHCISA: ATTEND

Published October 12, 2026

CISO Take

MONAI versions 0.4.0 up to 1.6.1 download pretrained SENet weights over plaintext HTTP and load them with an unsafe pickle deserializer (CWE-502). An on-path attacker can swap in a crafted .pth file, and code runs as soon as a model such as SEResNet50 is built with pretrained=True. Exploitation needs a network position and a user or pipeline to trigger the load, so it is rated high (CVSS 7.5) rather than critical. There is no public exploit, no Nuclei template and no KEV listing, and EPSS data is not yet available. Still, 127 downstream dependents and a package with 16 other CVEs mean medical-imaging and research pipelines are exposed, and these often run on GPU hosts with broad data access. Upgrade MONAI to 1.6.1 or later, and until then avoid pretrained=True for SENet models or pre-stage verified weights from a trusted source.

Sources:NVDGitHub AdvisoryATLASOpenSSFVulnCheck

What is the risk?

Medium-high. Impact is full confidentiality, integrity and availability loss on the host that loads the weights. Attack complexity is high because the attacker needs an on-path position (shared network, compromised proxy, hostile Wi-Fi or DNS hijack), and user interaction is required to build the model. There is no public exploit and no known active exploitation. Risk rises in environments that fetch weights at runtime from CI runners, notebooks, training clusters or containers with unrestricted outbound HTTP, especially those that hold patient data, credentials or cloud tokens.

How does the attack unfold?

Interception

An on-path attacker intercepts the plaintext HTTP request for SENet pretrained weights.

AML.T0010.003

Payload substitution

The attacker returns a crafted .pth file carrying a malicious pickle payload.

AML.T0018.002

Code execution

Building SEResNet50 with pretrained=True unpickles the file and runs attacker code in the Python process.

AML.T0011.000

Impact

The attacker steals datasets and credentials and can tamper with trained models from the compromised host.

Interception

An on-path attacker intercepts the plaintext HTTP request for SENet pretrained weights.

AML.T0010.003

Payload substitution

The attacker returns a crafted .pth file carrying a malicious pickle payload.

AML.T0018.002

Code execution

Building SEResNet50 with pretrained=True unpickles the file and runs attacker code in the Python process.

AML.T0011.000

Impact

The attacker steals datasets and credentials and can tamper with trained models from the compromised host.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
MONAI	pip	—	No patch
8.8KOpenSSF 7.9128 dependentsPushed 7d ago41% patched~21d to patchFull package profile →
MONAI	pip	—	No patch
8.8KOpenSSF 7.9128 dependentsPushed 7d ago41% patched~21d to patchFull package profile →

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.6%

chance of exploitation in 30 days

Higher than 47% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACHigh

PRNone

UIRequired

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade MONAI to 1.6.1 or later. 2) Until patched, do not use pretrained=True for SENet models; download weights from a trusted HTTPS source, verify their checksums, and load them locally. 3) Block or monitor outbound plaintext HTTP from ML hosts and force egress through a TLS-inspecting proxy or an allowlist. 4) Prefer safetensors or torch.load with weights_only=True for any weight files. 5) Run training and notebook jobs in least-privilege, network-restricted containers with short-lived credentials. 6) Detect by searching code and CI logs for pretrained SENet construction and for HTTP requests to weight hosts, and by alerting on unexpected child processes spawned from Python training jobs. 7) Cache verified weights in an internal artifact store.

What does CISA's SSVC say?

DecisionAttend

Exploitationpoc

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Supply ChainCode ExecutionFrameworkModelTraining DataAML.T0010.001- AI Software AML.T0010.003- Model AML.T0011.000- Unsafe AI Artifacts AML.T0018.002- Embed Malware

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.10.3-Suppliers

NIST AI RMF

MAP 4.1-Risks of third-party software and data are mapped

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-109360?

Is CVE-2026-109360 actively exploited?

No confirmed active exploitation of CVE-2026-109360 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-109360?

1) Upgrade MONAI to 1.6.1 or later. 2) Until patched, do not use pretrained=True for SENet models; download weights from a trusted HTTPS source, verify their checksums, and load them locally. 3) Block or monitor outbound plaintext HTTP from ML hosts and force egress through a TLS-inspecting proxy or an allowlist. 4) Prefer safetensors or torch.load with weights_only=True for any weight files. 5) Run training and notebook jobs in least-privilege, network-restricted containers with short-lived credentials. 6) Detect by searching code and CI logs for pretrained SENet construction and for HTTP requests to weight hosts, and by alerting on unexpected child processes spawned from Python training jobs. 7) Cache verified weights in an internal artifact store.

What systems are affected by CVE-2026-109360?

This vulnerability affects the following AI/ML architecture patterns: training pipelines, model development notebooks, medical imaging ML pipelines, CI/CD for ML, model fine-tuning workflows.

What is the CVSS score for CVE-2026-109360?

CVE-2026-109360 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.56%.

What is the AI security impact?

Affected AI Architectures

training pipelinesmodel development notebooksmedical imaging ML pipelinesCI/CD for MLmodel fine-tuning workflows

MITRE ATLAS Techniques

AML.T0010.001AI Software

AML.T0010.003Model

AML.T0011.000Unsafe AI Artifacts

AML.T0018.002Embed Malware

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.10.3

NIST AI RMF: MAP 4.1

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

MONAI 0.4.0 before 1.6.1 contains a remote code execution vulnerability that allows on-path attackers to execute code by tampering with SENet pretrained weights fetched over plaintext HTTP. Attackers can substitute a crafted .pth file that load_state_dict_from_url unpickles without weights_only=True, executing code when SEResNet50 or other SENet models are constructed with pretrained=True.

Exploitation Scenario

An attacker on the same network segment as a research GPU server, or controlling a compromised proxy or DNS, waits for a MONAI job to request the SENet pretrained weights over HTTP. They answer with a malicious .pth file containing a pickle payload. When the data scientist's script builds SEResNet50 with pretrained=True, load_state_dict_from_url unpickles the file and runs the payload. This yields a reverse shell, theft of cloud credentials and patient datasets, and a foothold for tampering with trained models.

Weaknesses (CWE)

CWE-502Deserialization of Untrusted DataPrimary CWE-502Deserialization of Untrusted Data

CWE-502 — Deserialization of Untrusted Data: The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

[Architecture and Design, Implementation] If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
[Implementation] When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.

Source: MITRE CWE corpus.