CVE-2026-6601

CVE-2026-6601 is a resource consumption vulnerability affecting Lagom WHMCS Template versions up to 2.4.2, specifically impacting an unknown function within the Datatables component. This flaw allows remote attackers to cause denial of service conditions by exhausting server resources. The vendor has been notified but has not responded to the disclosure. The vulnerability carries a CVSS score of 4.3 (Medium severity) with a network-based attack vector requiring low complexity and authenticated access. While the impact is limited to availability disruption with no confidentiality or integrity compromise, the ease of exploitation and accessibility over the network present moderate operational risk. The FAUCET Risk Score of 38.0 suggests manageable but non-trivial concern. The exploit details have been publicly disclosed, and active exploitation attempts have been observed in the wild as indicated by the Hot List designation. However, the EPSS score of 0.00037 indicates relatively low probability of exploitation in real-world scenarios. Organizations operating affected WHMCS installations should prioritize patching or upgrading to version 2.4.3 or later to mitigate availability risks.