SGLang vulnerability exposes inference servers

VicOne disclosed CVE-2026-86793, a SGLang flaw that can let a remote unauthenticated attacker execute code on deployments through version 0.5.14, according to the security researcher’s disclosure. OpenCVE’s record lists it as published September 11 with no CVSS or KEV entry yet, so severity metadata has not caught up with consequence. If you run SGLang, keep its inference surface private and verify authentication and patch status before exposure; the paper’s exploit-window analysis explains why an unpatched model server is a production risk, not a benchmark detail.