Common Weakness Enumeration
CWE-269
DiscouragedImproper Privilege Management
Abstraction: Class · Status: Draft
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
6622 vulnerabilities reference this CWE, most recent first.
CVE-2026-1566 (GCVE-0-2026-1566)
Vulnerability from cvelistv5 – Published: 2026-03-02 23:22 – Updated: 2026-04-08 17:21
VLAI
EPSS
VEX
Title
LatePoint <= 5.2.7 - Authenticated (Agent+) Privilege Escalation
Summary
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to privilege escalation via password reset in all versions up to, and including, 5.2.7. This is due to the plugin allowing users with a LatePoint Agent role, who are creating new customers to set the 'wordpress_user_id' field. This makes it possible for authenticated attackers, with Agent-level access and above, to gain elevated privileges by linking a customer to the arbitrary user ID, including administrators, and then resetting the password.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-03 01:52 UTC
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| latepoint | LatePoint – Calendar Booking Plugin for Appointments and Events |
Affected:
0 , ≤ 5.2.7
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-1566",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-03T01:52:05.848759Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-03T01:52:20.828Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "LatePoint \u2013 Calendar Booking Plugin for Appointments and Events",
"vendor": "latepoint",
"versions": [
{
"lessThanOrEqual": "5.2.7",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Hung Nguyen"
}
],
"descriptions": [
{
"lang": "en",
"value": "The LatePoint \u2013 Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to privilege escalation via password reset in all versions up to, and including, 5.2.7. This is due to the plugin allowing users with a LatePoint Agent role, who are creating new customers to set the \u0027wordpress_user_id\u0027 field. This makes it possible for authenticated attackers, with Agent-level access and above, to gain elevated privileges by linking a customer to the arbitrary user ID, including administrators, and then resetting the password."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T17:21:48.917Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c958880e-6068-4e7d-a780-1251f3ab9bf7?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3463945/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-01-23T00:00:00.000Z",
"value": "Discovered"
},
{
"lang": "en",
"time": "2026-01-28T20:52:12.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-03-02T11:03:51.000Z",
"value": "Disclosed"
}
],
"title": "LatePoint \u003c= 5.2.7 - Authenticated (Agent+) Privilege Escalation"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-1566",
"datePublished": "2026-03-02T23:22:55.673Z",
"dateReserved": "2026-01-28T20:18:56.426Z",
"dateUpdated": "2026-04-08T17:21:48.917Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-1492 (GCVE-0-2026-1492)
Vulnerability from cvelistv5 – Published: 2026-03-03 04:33 – Updated: 2026-04-08 17:03
VLAI
EPSS
VEX
Title
User Registration & Membership <= 5.1.2 - Unauthenticated Privilege Escalation via Membership Registration
Summary
The User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to improper privilege management in all versions up to, and including, 5.1.2. This is due to the plugin accepting a user-supplied role during membership registration without properly enforcing a server-side allowlist. This makes it possible for unauthenticated attackers to create administrator accounts by supplying a role value during membership registration.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-03 15:33 UTC
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wpeverest | User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder |
Affected:
0 , ≤ 5.1.2
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-1492",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-03T15:33:14.680160Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-03T15:33:25.942Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "User Registration \u0026 Membership \u2013 Free \u0026 Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration \u0026 Login Builder",
"vendor": "wpeverest",
"versions": [
{
"lessThanOrEqual": "5.1.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Friderika Baranyai"
}
],
"descriptions": [
{
"lang": "en",
"value": "The User Registration \u0026 Membership \u2013 Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction \u0026 Membership Plugin plugin for WordPress is vulnerable to improper privilege management in all versions up to, and including, 5.1.2. This is due to the plugin accepting a user-supplied role during membership registration without properly enforcing a server-side allowlist. This makes it possible for unauthenticated attackers to create administrator accounts by supplying a role value during membership registration."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T17:03:11.800Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7e9fec92-f471-4ce9-9138-1c58ad658da2?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3469042/user-registration"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-01-27T18:52:32.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-03-02T16:05:18.000Z",
"value": "Disclosed"
}
],
"title": "User Registration \u0026 Membership \u003c= 5.1.2 - Unauthenticated Privilege Escalation via Membership Registration"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-1492",
"datePublished": "2026-03-03T04:33:20.922Z",
"dateReserved": "2026-01-27T14:38:16.707Z",
"dateUpdated": "2026-04-08T17:03:11.800Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-1010 (GCVE-0-2026-1010)
Vulnerability from cvelistv5 – Published: 2026-01-15 23:00 – Updated: 2026-02-05 22:07
VLAI
EPSS
VEX
Title
Stored Cross-Site Scripting in Altium Enterprise Server Workflow Engine Allows Privilege Escalation
Summary
A stored cross-site scripting (XSS) vulnerability exists in the Altium Workflow Engine due to missing server-side input sanitization in workflow form submission APIs. A regular authenticated user can inject arbitrary JavaScript into workflow data.
When an administrator views the affected workflow, the injected payload executes in the administrator’s browser context, allowing privilege escalation, including creation of new administrator accounts, session token theft, and execution of administrative actions.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-16 17:05 UTC
CWE
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Altium | Altium Enterprise Server |
Affected:
0 , ≤ 8.0.1
(semver)
|
Date Public
2026-01-15 22:58
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-1010",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-16T17:05:21.932214Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-16T17:05:38.769Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"Workflow Engine (Part Request submit-form API)"
],
"platforms": [
"Web"
],
"product": "Altium Enterprise Server",
"vendor": "Altium",
"versions": [
{
"lessThanOrEqual": "8.0.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"datePublic": "2026-01-15T22:58:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A stored cross-site scripting (XSS) vulnerability exists in the Altium Workflow Engine due to missing server-side input sanitization in workflow form submission APIs. A regular authenticated user can inject arbitrary JavaScript into workflow data.\u003cbr\u003e\u003cbr\u003eWhen an administrator views the affected workflow, the injected payload executes in the administrator\u2019s browser context, allowing privilege escalation, including creation of new administrator accounts, session token theft, and execution of administrative actions.\u003cbr\u003e\u003cbr\u003e"
}
],
"value": "A stored cross-site scripting (XSS) vulnerability exists in the Altium Workflow Engine due to missing server-side input sanitization in workflow form submission APIs. A regular authenticated user can inject arbitrary JavaScript into workflow data.\n\nWhen an administrator views the affected workflow, the injected payload executes in the administrator\u2019s browser context, allowing privilege escalation, including creation of new administrator accounts, session token theft, and execution of administrative actions."
}
],
"impacts": [
{
"capecId": "CAPEC-63",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-63 Cross-Site Scripting (XSS)"
}
]
},
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-05T22:07:23.193Z",
"orgId": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79",
"shortName": "Altium"
},
"references": [
{
"url": "https://www.altium.com/platform/security-compliance/security-advisories"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Stored Cross-Site Scripting in Altium Enterprise Server Workflow Engine Allows Privilege Escalation",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79",
"assignerShortName": "Altium",
"cveId": "CVE-2026-1010",
"datePublished": "2026-01-15T23:00:18.163Z",
"dateReserved": "2026-01-15T22:08:47.337Z",
"dateUpdated": "2026-02-05T22:07:23.193Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-0920 (GCVE-0-2026-0920)
Vulnerability from cvelistv5 – Published: 2026-01-22 06:47 – Updated: 2026-04-08 16:57
VLAI
EPSS
VEX
Title
LA-Studio Element Kit for Elementor <= 1.5.6.3 - Unauthenticated Privilege Escalation via Backdoor to Administrative User Creation via lakit_bkrole parameter
Summary
The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Administrative User Creation in all versions up to, and including, 1.5.6.3. This is due to the 'ajax_register_handle' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'lakit_bkrole' parameter during registration and gain administrator access to the site.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-22 15:19 UTC
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| choijun | LA-Studio Element Kit for Elementor |
Affected:
0 , ≤ 1.5.6.3
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-0920",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-22T15:19:47.839698Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-22T15:20:27.030Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "LA-Studio Element Kit for Elementor",
"vendor": "choijun",
"versions": [
{
"lessThanOrEqual": "1.5.6.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Athiwat Tiprasaharn"
},
{
"lang": "en",
"type": "finder",
"value": "Itthidej Aramsri"
},
{
"lang": "en",
"type": "finder",
"value": "Waris Damkham"
}
],
"descriptions": [
{
"lang": "en",
"value": "The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Administrative User Creation in all versions up to, and including, 1.5.6.3. This is due to the \u0027ajax_register_handle\u0027 function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the \u0027lakit_bkrole\u0027 parameter during registration and gain administrator access to the site."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T16:57:54.646Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/65ebc744-6cc2-47ce-b225-81820e49d59c?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/lastudio-element-kit/tags/1.5.6.3/includes/integrations/override.php#L301"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3439121/lastudio-element-kit"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-01-13T20:13:10.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-01-21T17:31:45.000Z",
"value": "Disclosed"
}
],
"title": "LA-Studio Element Kit for Elementor \u003c= 1.5.6.3 - Unauthenticated Privilege Escalation via Backdoor to Administrative User Creation via lakit_bkrole parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-0920",
"datePublished": "2026-01-22T06:47:19.614Z",
"dateReserved": "2026-01-13T19:56:37.679Z",
"dateUpdated": "2026-04-08T16:57:54.646Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-0912 (GCVE-0-2026-0912)
Vulnerability from cvelistv5 – Published: 2026-02-19 04:36 – Updated: 2026-04-08 16:50
VLAI
EPSS
VEX
Title
Toret Manager <= 1.2.7 - Authenticated (Subscriber+) Arbitrary Options Update via AJAX actions
Summary
The Toret Manager plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'trman_save_option' function and on the 'trman_save_option_items' in all versions up to, and including, 1.2.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-19 17:07 UTC
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| toret | Toret Manager |
Affected:
0 , ≤ 1.2.7
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-0912",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-19T17:07:18.711984Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-19T17:38:08.506Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Toret Manager",
"vendor": "toret",
"versions": [
{
"lessThanOrEqual": "1.2.7",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "vgo0"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Toret Manager plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the \u0027trman_save_option\u0027 function and on the \u0027trman_save_option_items\u0027 in all versions up to, and including, 1.2.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T16:50:57.475Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4b2fc891-f3c6-4f4f-ad52-0a1a949eed25?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/toret-manager/tags/1.2.7/admin/class-toret-manager-admin.php#L210"
},
{
"url": "https://plugins.trac.wordpress.org/browser/toret-manager/tags/1.2.7/admin/class-toret-manager-admin.php#L227"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3464839/toret-manager"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-02-18T15:52:51.000Z",
"value": "Disclosed"
}
],
"title": "Toret Manager \u003c= 1.2.7 - Authenticated (Subscriber+) Arbitrary Options Update via AJAX actions"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-0912",
"datePublished": "2026-02-19T04:36:10.131Z",
"dateReserved": "2026-01-13T18:41:22.149Z",
"dateUpdated": "2026-04-08T16:50:57.475Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0431
Vulnerability from gna-1988 – Published: 2026-10-02 04:57 – Updated: 2026-10-02 04:57
VLAI
EPSS
VEX
Title
[0day-rubbish] Server Technology PRO3X PDU 030600 port_mux listener program override to root command execution (7.2)
Summary
0day Rubbish Research Team is publicly disclosing a vulnerability in Server
Technology (Legrand group) PRO3X series intelligent rack PDUs, firmware
spdu-pro3x-030600 build 46640 (ARM 32-bit uClibc Linux).
Type: authenticated listener program override leading to root command execution
(CWE-78, CWE-269; a separate hard-coded factory credential is reported as
CWE-798). PRO3X PDUs run port_mux, an inetd-style launcher that starts every
protocol listener with fork + execv and never drops privileges, so listeners run
as root. The executable path is proto_listener_entry.program in cfg_pmux.cdl,
typed nctl_nspc_nempty_str_512, a free-form string with no whitelist, and an
authenticated administrator rewrites it through setConfiguration (POST /J/cfg).
Pointing the port 80 http listener at /bin/sh with arguments -c "<cmd>" applies at
runtime: the next TCP connection to port 80 executes the attacker's command as
uid 0.
Scoring. This finding is dual-scored, with the conditional figure published
alongside the primary:
- PRIMARY, 7.2 High, CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. An
authenticated administrator is required, and that gate was verified unbypassed.
- CONDITIONAL, 9.8 Critical, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Where
the factory default administrator credential is left unchanged, unrotated units
are open with no privileged secret.
Impact: root (uid 0) on the rack power distribution controller, a
critical-infrastructure power monitoring and control appliance. Full configuration
control follows; the disabled modbus (502) and mbusd (503) listeners can be armed
with attacker-chosen programs. Outlet switching and power cycling were not
separately exercised by this proof-of-concept.
Authentication: post-authentication administrator (with a shipped default
administrator credential reported separately as CWE-798).
Verification boundary, stated plainly. No physical PRO3X hardware was used, and
the three-step HTTP chain (POST /J/auth, POST /J/cfg, then the TCP trigger) was
NOT exercised end to end against a device. What was dynamically proven is the
root execution primitive: port_mux fork + execv of an injected /bin/sh -c as uid
0, run twice inside a network namespace under qemu-arm-static against the
rootfs unpacked from the firmware Squashfs, each producing a root-owned marker
containing uid=0(root). Each link of the HTTP delivery path was confirmed
component by component (httpd.conf routing, the BusyBox SCM_RIGHTS descriptor
passing, the administrator credential accepted by auth_cli, and the configuration
write accepted and read back through cfgc). SCM_RIGHTS descriptor passing between
the separate httpd and jsonrpcd processes does not complete under qemu user-mode
emulation, which is an emulation-environment limitation rather than a property of
the vulnerability. Only this build was tested; no other build or model is claimed.
Full technical analysis and a reproducible proof-of-concept:
https://0day-rubbish.com/blog/servertech-pro3x-port-mux-command-injection
Project archive (ongoing disclosure series):
https://github.com/Exploit-Garbage/0day-Rubbish
The vendor has been notified through its published security contact. No vulnerability identifier has been assigned to
this finding yet.
--
0day Rubbish Research Team
disclosure () 0day-rubbish com
https://0day-rubbish.com
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| unknown | Server Technology PRO3X |
Affected:
unknown
|
{
"containers": {
"cna": {
"affected": [
{
"product": "Server Technology PRO3X",
"vendor": "unknown",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "disclosure via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "0day Rubbish Research Team is publicly disclosing a vulnerability in Server\nTechnology (Legrand group) PRO3X series intelligent rack PDUs, firmware\nspdu-pro3x-030600 build 46640 (ARM 32-bit uClibc Linux).\n\nType: authenticated listener program override leading to root command execution\n(CWE-78, CWE-269; a separate hard-coded factory credential is reported as\nCWE-798). PRO3X PDUs run port_mux, an inetd-style launcher that starts every\nprotocol listener with fork + execv and never drops privileges, so listeners run\nas root. The executable path is proto_listener_entry.program in cfg_pmux.cdl,\ntyped nctl_nspc_nempty_str_512, a free-form string with no whitelist, and an\nauthenticated administrator rewrites it through setConfiguration (POST /J/cfg).\nPointing the port 80 http listener at /bin/sh with arguments -c \"\u003ccmd\u003e\" applies at\nruntime: the next TCP connection to port 80 executes the attacker\u0027s command as\nuid 0.\n\nScoring. This finding is dual-scored, with the conditional figure published\nalongside the primary:\n- PRIMARY, 7.2 High, CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. An\n authenticated administrator is required, and that gate was verified unbypassed.\n- CONDITIONAL, 9.8 Critical, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Where\n the factory default administrator credential is left unchanged, unrotated units\n are open with no privileged secret.\n\nImpact: root (uid 0) on the rack power distribution controller, a\ncritical-infrastructure power monitoring and control appliance. Full configuration\ncontrol follows; the disabled modbus (502) and mbusd (503) listeners can be armed\nwith attacker-chosen programs. Outlet switching and power cycling were not\nseparately exercised by this proof-of-concept.\n\nAuthentication: post-authentication administrator (with a shipped default\nadministrator credential reported separately as CWE-798).\n\nVerification boundary, stated plainly. No physical PRO3X hardware was used, and\nthe three-step HTTP chain (POST /J/auth, POST /J/cfg, then the TCP trigger) was\nNOT exercised end to end against a device. What was dynamically proven is the\nroot execution primitive: port_mux fork + execv of an injected /bin/sh -c as uid\n0, run twice inside a network namespace under qemu-arm-static against the\nrootfs unpacked from the firmware Squashfs, each producing a root-owned marker\ncontaining uid=0(root). Each link of the HTTP delivery path was confirmed\ncomponent by component (httpd.conf routing, the BusyBox SCM_RIGHTS descriptor\npassing, the administrator credential accepted by auth_cli, and the configuration\nwrite accepted and read back through cfgc). SCM_RIGHTS descriptor passing between\nthe separate httpd and jsonrpcd processes does not complete under qemu user-mode\nemulation, which is an emulation-environment limitation rather than a property of\nthe vulnerability. Only this build was tested; no other build or model is claimed.\n\nFull technical analysis and a reproducible proof-of-concept:\n https://0day-rubbish.com/blog/servertech-pro3x-port-mux-command-injection\n\nProject archive (ongoing disclosure series):\n https://github.com/Exploit-Garbage/0day-Rubbish\n\nThe vendor has been notified through its published security contact. No vulnerability identifier has been assigned to\nthis finding yet.\n\n--\n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-78",
"description": "CWE-78",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-798",
"description": "CWE-798",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-02T04:57:33Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/79"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Sep/79"
},
{
"url": "https://0day-rubbish.com"
},
{
"url": "https://0day-rubbish.com/blog/servertech-pro3x-port-mux-command-injection"
},
{
"url": "https://github.com/Exploit-Garbage/0day-Rubbish"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Sep/79"
],
"discovery": "EXTERNAL"
},
"title": "[0day-rubbish] Server Technology PRO3X PDU 030600 port_mux listener program override to root command execution (7.2)",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0431",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/79",
"automated": true,
"contentSha256": "9914d9e5c60c365c9e58406f57ddde29b4945a74adbb372e4574a6056b52e5be",
"evidenceScore": 11,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/79",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-09-23T04:55:27Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-10-02T04:57:33Z",
"dateUpdated": "2026-10-02T04:57:33Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0431"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0424
Vulnerability from gna-1988 – Published: 2026-10-02 04:57 – Updated: 2026-10-02 04:57
VLAI
EPSS
VEX
Title
[0day-rubbish] Cambium cnMatrix EX3024F 6.2.1-r4 SSL CSR COMMON_NAME command injection to root RCE (7.2)
Summary
0day Rubbish Research Team is publicly disclosing a vulnerability in the Cambium
cnMatrix EX3024F managed switch, firmware 6.2.1-r4.
Type: OS command injection (CWE-78, with CWE-20 bearing on it because
percent-decoding is the only processing applied; CWE-250/CWE-269 bear on
remediation priority). The COMMON_NAME form field submitted to
POST /iss/specific/ssl_digitalcert.html is extracted by HttpGetValuebyName,
percent-decoded by issDecodeSpecialChar, copied with strncpy(buf, COMMON_NAME,
100) and interpolated unfiltered into the double-quoted -subj "%s" argument of an
openssl req command string that the management daemon ISS.exe hands to system().
Five functions stand between the HTTP parser and the sink and none validate the
data. A subject of ";id;echo " closes the quote and injects a statement; the
daemon runs as root, so the injected command does too.
Scoring. This finding is dual-scored, with the deployment-conditional upper
bound published alongside the verified baseline:
- PRIMARY baseline, 7.2 High, CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. A
valid administrative session is required; the page is gated by a server-side
session table plus an administrator privilege check that is on by default.
- CONDITIONAL, 9.8 Critical, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. A
deployment-conditional upper bound where an installation retains a default,
weak or publicly known administrator password, a common condition for network
switches; the privilege prerequisite collapses in practice while the technical
chain is unchanged.
The advisory does not adopt the recorded vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
with its paired 8.8, because the analysis documents an administrator-only check
rather than any-low-privilege-user access, so PR:H (7.2) is the faithful metric.
A 9.1 scope-changed reading is also rejected: the compromised OS and the daemon
sit inside one authorization domain, the daemon being already root over that OS.
Impact: root command execution on a managed switch, a forwarding-plane device
rather than only a management plane: full compromise of configuration and keys,
installation of a persistent backdoor that survives reboot, a pivot into adjacent
segments, and live manipulation or denial of the traffic it carries.
Authentication: post-authentication administrator.
Verification boundary, stated plainly. Confirmation used an extracted firmware
image under qemu-aarch64-static user-mode emulation. Because the daemon cannot
complete initialisation without the Marvell switch ASIC driver and never binds an
HTTP port in emulation, the real shipped sink function (SslGenCertRequest) was
invoked directly under debugger control with the payload an HTTP POST would
deliver; it returned 0 and wrote a 36-byte root-owned marker containing
uid=0(root) gid=0(root). End-to-end HTTP exploitation against a device was NOT
performed and no physical hardware was used. The five-handler HTTP-to-sink path
is proven statically by decompilation and cross-reference, not by an observed
network request. Any model or firmware revision beyond EX3024F 6.2.1-r4 is
inference and unconfirmed.
Full technical analysis and a reproducible proof-of-concept:
https://0day-rubbish.com/blog/cambium-cnmatrix-ssl-csr-command-injection
Project archive (ongoing disclosure series):
https://github.com/Exploit-Garbage/0day-Rubbish
The vendor has been notified through its published security contact. No vulnerability identifier has been assigned to
this finding yet.
--
0day Rubbish Research Team
disclosure () 0day-rubbish com
https://0day-rubbish.com
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Cambium | cnMatrix EX3024F |
Affected:
unknown
|
{
"containers": {
"cna": {
"affected": [
{
"product": "cnMatrix EX3024F",
"vendor": "Cambium",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "disclosure via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "0day Rubbish Research Team is publicly disclosing a vulnerability in the Cambium\ncnMatrix EX3024F managed switch, firmware 6.2.1-r4.\n\nType: OS command injection (CWE-78, with CWE-20 bearing on it because\npercent-decoding is the only processing applied; CWE-250/CWE-269 bear on\nremediation priority). The COMMON_NAME form field submitted to\nPOST /iss/specific/ssl_digitalcert.html is extracted by HttpGetValuebyName,\npercent-decoded by issDecodeSpecialChar, copied with strncpy(buf, COMMON_NAME,\n100) and interpolated unfiltered into the double-quoted -subj \"%s\" argument of an\nopenssl req command string that the management daemon ISS.exe hands to system().\nFive functions stand between the HTTP parser and the sink and none validate the\ndata. A subject of \";id;echo \" closes the quote and injects a statement; the\ndaemon runs as root, so the injected command does too.\n\nScoring. This finding is dual-scored, with the deployment-conditional upper\nbound published alongside the verified baseline:\n- PRIMARY baseline, 7.2 High, CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. A\n valid administrative session is required; the page is gated by a server-side\n session table plus an administrator privilege check that is on by default.\n- CONDITIONAL, 9.8 Critical, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. A\n deployment-conditional upper bound where an installation retains a default,\n weak or publicly known administrator password, a common condition for network\n switches; the privilege prerequisite collapses in practice while the technical\n chain is unchanged.\n\nThe advisory does not adopt the recorded vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\nwith its paired 8.8, because the analysis documents an administrator-only check\nrather than any-low-privilege-user access, so PR:H (7.2) is the faithful metric.\nA 9.1 scope-changed reading is also rejected: the compromised OS and the daemon\nsit inside one authorization domain, the daemon being already root over that OS.\n\nImpact: root command execution on a managed switch, a forwarding-plane device\nrather than only a management plane: full compromise of configuration and keys,\ninstallation of a persistent backdoor that survives reboot, a pivot into adjacent\nsegments, and live manipulation or denial of the traffic it carries.\n\nAuthentication: post-authentication administrator.\n\nVerification boundary, stated plainly. Confirmation used an extracted firmware\nimage under qemu-aarch64-static user-mode emulation. Because the daemon cannot\ncomplete initialisation without the Marvell switch ASIC driver and never binds an\nHTTP port in emulation, the real shipped sink function (SslGenCertRequest) was\ninvoked directly under debugger control with the payload an HTTP POST would\ndeliver; it returned 0 and wrote a 36-byte root-owned marker containing\nuid=0(root) gid=0(root). End-to-end HTTP exploitation against a device was NOT\nperformed and no physical hardware was used. The five-handler HTTP-to-sink path\nis proven statically by decompilation and cross-reference, not by an observed\nnetwork request. Any model or firmware revision beyond EX3024F 6.2.1-r4 is\ninference and unconfirmed.\n\nFull technical analysis and a reproducible proof-of-concept:\n https://0day-rubbish.com/blog/cambium-cnmatrix-ssl-csr-command-injection\n\nProject archive (ongoing disclosure series):\n https://github.com/Exploit-Garbage/0day-Rubbish\n\nThe vendor has been notified through its published security contact. No vulnerability identifier has been assigned to\nthis finding yet.\n\n--\n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-250",
"description": "CWE-250",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-269",
"description": "CWE-269",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-78",
"description": "CWE-78",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-02T04:57:33Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/70"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Sep/70"
},
{
"url": "https://0day-rubbish.com"
},
{
"url": "https://0day-rubbish.com/blog/cambium-cnmatrix-ssl-csr-command-injection"
},
{
"url": "https://github.com/Exploit-Garbage/0day-Rubbish"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Sep/70"
],
"discovery": "EXTERNAL"
},
"title": "[0day-rubbish] Cambium cnMatrix EX3024F 6.2.1-r4 SSL CSR COMMON_NAME command injection to root RCE (7.2)",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0424",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/70",
"automated": true,
"contentSha256": "1432ddd5efb94e1fd31e8f24bdf9084ce610345f06a6ed2de63e30ff2060564d",
"evidenceScore": 11,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/70",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-09-23T04:53:44Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-10-02T04:57:33Z",
"dateUpdated": "2026-10-02T04:57:33Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0424"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-0276 (GCVE-0-2026-0276)
Vulnerability from cvelistv5 – Published: 2026-07-09 19:17 – Updated: 2026-07-14 14:32
VLAI
EPSS
VEX
Title
Cortex XDR Broker VM: Privilege Escalation (PE) Vulnerability
Summary
A privilege escalation vulnerability in Palo Alto Networks Cortex® XDR Broker VM enables a locally authenticated user to perform actions as the root user.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-11 03:55 UTC
CWE
- CWE-269 - — Improper Privilege Management
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.paloaltonetworks.com/CVE-2026-0276 | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Palo Alto Networks | Cortex XDR Broker VM |
Affected:
20.0.96 , < 31.0.58
(custom)
cpe:2.3:a:palo_alto_networks:cortex_xdr_broker_vm:*:*:*:*:*:*:*:* |
Date Public
2026-07-08 16:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-0276",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-11T03:55:16.207452Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T14:32:13.977Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Cortex XDR Broker VM",
"vendor": "Palo Alto Networks",
"versions": [
{
"changes": [
{
"at": "31.0.58",
"status": "unaffected"
}
],
"lessThan": "31.0.58",
"status": "affected",
"version": "20.0.96",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cspan\u003eNo special configuration is required to be affected by this issue.\u003c/span\u003e\u003cbr\u003e\u003c/p\u003e"
}
],
"value": "No special configuration is required to be affected by this issue."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:palo_alto_networks:cortex_xdr_broker_vm:*:*:*:*:*:*:*:*",
"versionEndExcluding": "31.0.58",
"versionStartIncluding": "20.0.96",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Palo Alto Networks thanks Martin Rougeron for discovering and reporting this issue"
}
],
"datePublic": "2026-07-08T16:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A privilege escalation vulnerability in Palo Alto Networks Cortex\u00ae XDR Broker VM enables a locally authenticated user to perform actions as the root user."
}
],
"value": "A privilege escalation vulnerability in Palo Alto Networks Cortex\u00ae XDR Broker VM enables a locally authenticated user to perform actions as the root user."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
],
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NO",
"Recovery": "USER",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 1.1,
"baseSeverity": "LOW",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "LOW",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 \u2014 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-09T19:17:01.145Z",
"orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"shortName": "palo_alto"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.paloaltonetworks.com/CVE-2026-0276"
}
],
"solutions": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThis issue is fixed in Cortex XDR Broker VM 31.0.58, and all later Cortex XDR Broker VM versions.\u003c/p\u003e\u003cul\u003e\u003cli\u003e\u003cp\u003eIf automatic upgrades are enabled for Broker VM, then no action is required at this time.\u003c/p\u003e\u003c/li\u003e\u003c/ul\u003e\u003cul\u003e\u003cli\u003e\u003cp\u003eIf automatic upgrades are not enabled for Broker VM, then we recommend that you do so to ensure that you always have the latest security patches installed in your software.\u003c/p\u003e\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "This issue is fixed in Cortex XDR Broker VM 31.0.58, and all later Cortex XDR Broker VM versions.\n\n * \n\nIf automatic upgrades are enabled for Broker VM, then no action is required at this time.\n\n\n\n\n * \n\nIf automatic upgrades are not enabled for Broker VM, then we recommend that you do so to ensure that you always have the latest security patches installed in your software."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-07-08T16:00:00.000Z",
"value": "Initial publication."
}
],
"title": "Cortex XDR Broker VM: Privilege Escalation (PE) Vulnerability",
"workarounds": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "No known workarounds exist for this issue."
}
],
"value": "No known workarounds exist for this issue."
}
],
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"assignerShortName": "palo_alto",
"cveId": "CVE-2026-0276",
"datePublished": "2026-07-09T19:17:01.145Z",
"dateReserved": "2025-11-03T20:44:35.481Z",
"dateUpdated": "2026-07-14T14:32:13.977Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-0275 (GCVE-0-2026-0275)
Vulnerability from cvelistv5 – Published: 2026-07-09 19:19 – Updated: 2026-07-14 14:32
VLAI
EPSS
VEX
Title
Prisma Browser: Local Privilege Escalation on macOS
Summary
A local privilege escalation vulnerability in Palo Alto Networks Prisma® Browser allows a locally authenticated administrator with access to the macOS local filesystem to perform actions on the device with root privileges.
This issue only affects Prisma® Browser on macOS.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-10 03:55 UTC
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.paloaltonetworks.com/CVE-2026-0275 | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Palo Alto Networks | Prisma Browser |
Affected:
150.33.2.0 , < 150.33.2.46
(custom)
cpe:2.3:a:palo_alto_networks:prisma_browser:*:*:macos:*:*:*:*:* |
Date Public
2026-07-08 16:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-0275",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-10T03:55:50.546784Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T14:32:31.774Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"macOS"
],
"product": "Prisma Browser",
"vendor": "Palo Alto Networks",
"versions": [
{
"changes": [
{
"at": "150.33.2.46",
"status": "unaffected"
}
],
"lessThan": "150.33.2.46",
"status": "affected",
"version": "150.33.2.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "No special configuration is required to be affected by this issue."
}
],
"value": "No special configuration is required to be affected by this issue."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:palo_alto_networks:prisma_browser:*:*:macos:*:*:*:*:*",
"versionEndExcluding": "150.33.2.46",
"versionStartIncluding": "150.33.2.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "other",
"value": "Palo Alto Networks thanks Kun Peeks (@SwayZGl1tZyyy) for discovering and reporting this issue."
}
],
"datePublic": "2026-07-08T16:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A local privilege escalation vulnerability in Palo Alto Networks Prisma\u00ae Browser allows a locally authenticated administrator with access to the macOS local filesystem to perform actions on the device with root privileges. \u003cbr\u003e\u003cbr\u003eThis issue only affects Prisma\u00ae Browser on macOS."
}
],
"value": "A local privilege escalation vulnerability in Palo Alto Networks Prisma\u00ae Browser allows a locally authenticated administrator with access to the macOS local filesystem to perform actions on the device with root privileges. \n\nThis issue only affects Prisma\u00ae Browser on macOS."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003ePalo Alto Networks is not aware of any malicious exploitation of this issue.\u003c/p\u003e"
}
],
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NO",
"Recovery": "USER",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 2,
"baseSeverity": "LOW",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "HIGH",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-09T19:19:24.198Z",
"orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"shortName": "palo_alto"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.paloaltonetworks.com/CVE-2026-0275"
}
],
"solutions": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003ctable\u003e\u003cthead\u003e\u003ctr\u003e\u003cth\u003eVersion\u003c/th\u003e\u003cth\u003eSuggested Solution\u003c/th\u003e\u003c/tr\u003e\u003c/thead\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003ePrisma Browser\u003c/td\u003e\u003ctd\u003eUpgrade to 150.33.2.46\u0026nbsp;or later.\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e"
}
],
"value": "VersionSuggested SolutionPrisma BrowserUpgrade to 150.33.2.46\u00a0or later."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-07-08T16:00:00.000Z",
"value": "Initial publication."
}
],
"title": "Prisma Browser: Local Privilege Escalation on macOS",
"workarounds": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "No known workarounds exist for this issue."
}
],
"value": "No known workarounds exist for this issue."
}
],
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"assignerShortName": "palo_alto",
"cveId": "CVE-2026-0275",
"datePublished": "2026-07-09T19:19:24.198Z",
"dateReserved": "2025-11-03T20:44:34.621Z",
"dateUpdated": "2026-07-14T14:32:31.774Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0016
Vulnerability from gna-1988 – Published: 2026-09-07 09:21 – Updated: 2026-09-07 09:21
VLAI
EPSS
VEX
Title
Silent;Call — Pre-Authentication Remote Root in Cisco CUCM 15.x (SKYLINE-2026-001/002/003)
Summary
## Advisory Information
- Advisory IDs: SKYLINE-2026-001, SKYLINE-2026-002, SKYLINE-2026-003
- Title: Pre-Authentication Remote Root via Tomcat Manager Header Injection + Hardcoded Credentials
- CVSSv3.1: 10.0 (Critical) — AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- CWE: CWE-798, CWE-644, CWE-269
- Product: Cisco Unified Communications Manager 15.0.1.12900-234
- Vendor: Cisco Systems, Inc.
- Public Disclosure: 2026-08-04
- Researcher: 0xReadingSteiner (0xReadingSteiner () proton me)
## Summary
A pre-authentication remote code execution chain in Cisco CUCM 15.x
allows an unauthenticated network attacker to achieve root-level access
in three HTTP requests.
The chain exploits:
1. RemoteIpValve misconfiguration — accepts X-Forwarded-For from any
source without internalProxies restriction, allowing IP spoofing
as 127.0.0.1
2. Hardcoded Tomcat Manager credentials — identical on every CUCM 15.x
installation (username: 1mJdd4WKi+ / password: 1ge1AVWsx~), not
configurable by administrators
3. Unrestricted sudo for the tomcat user — passwordless gdb with an
attacker-controlled command file in /tmp, plus three additional
independent root escalation paths (systemctl, PYTHONPATH, LD_PRELOAD)
## Impact
Root access to CUCM grants: interception of all voice communications
via SRTP key extraction, silent activation of built-in CALEA-compliant
lawful intercept wiretapping, access to all voicemail, complete CDR
exfiltration, call routing manipulation, E911 disruption, and lateral
movement into the voice VLAN.
CUCM is deployed in Fortune 500 companies, US federal agencies, the
Department of Defense, hospitals, financial institutions, law
enforcement, and telecommunications providers worldwide.
## Quick Test
curl -sk -H "X-Forwarded-For: 127.0.0.1" \
-u '1mJdd4WKi+:1ge1AVWsx~' \
"https://TARGET:443/manager/text/list";
If the response begins with "OK - Listed applications for virtual
host [localhost]" — the system is vulnerable.
## Vendor Coordination
- 17 CUCM submissions to ZDI — unprocessed
- SSD paused CUCM acquisitions (Cisco won't fix existing reports)
- Cisco PSIRT contacted 2026-08-04 — no response
- MITRE CVE IDs requested (CNA of Last Resort) — pending
This is advisory 1 of 55 identified vulnerabilities in CUCM 15.x.
## References
Full advisory: https://github.com/0xReadingSteiner/Silent-Call
PoC script: https://github.com/0xReadingSteiner/Silent-Call/blob/main/poc.sh
Master index: https://github.com/0xReadingSteiner/cisco-security-research
## Disclosure Statement
This research was conducted independently on commercially available
software in a private laboratory. No proprietary source code, internal
tools, or confidential information was used. Coordination was attempted
through three independent channels before publication.
Additional findings will be published on a rolling basis.
0xReadingSteiner
0xReadingSteiner@proton.mePGP: D5E22255F645A8B935056C278C0958C5D533080A
Sent with [Proton Mail](https://proton.me/mail/home) secure email.
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
9 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| unknown | Silent;Call — Pre-Authentication |
Affected:
unknown
|
Relationships
analysis
GCVE-1988-2026-0016 (this record)
- possibly related SKYLINE-2026-001
- possibly related SKYLINE-2026-002
- possibly related SKYLINE-2026-003
{
"containers": {
"cna": {
"affected": [
{
"product": "Silent;Call \u2014 Pre-Authentication",
"vendor": "unknown",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "0xReadingSteiner via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "## Advisory Information\n\n- Advisory IDs: SKYLINE-2026-001, SKYLINE-2026-002, SKYLINE-2026-003\n- Title: Pre-Authentication Remote Root via Tomcat Manager Header Injection + Hardcoded Credentials\n- CVSSv3.1: 10.0 (Critical) \u2014 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\n- CWE: CWE-798, CWE-644, CWE-269\n- Product: Cisco Unified Communications Manager 15.0.1.12900-234\n- Vendor: Cisco Systems, Inc.\n- Public Disclosure: 2026-08-04\n- Researcher: 0xReadingSteiner (0xReadingSteiner () proton me)\n\n## Summary\n\nA pre-authentication remote code execution chain in Cisco CUCM 15.x\nallows an unauthenticated network attacker to achieve root-level access\nin three HTTP requests.\n\nThe chain exploits:\n\n1. RemoteIpValve misconfiguration \u2014 accepts X-Forwarded-For from any\nsource without internalProxies restriction, allowing IP spoofing\nas 127.0.0.1\n\n2. Hardcoded Tomcat Manager credentials \u2014 identical on every CUCM 15.x\ninstallation (username: 1mJdd4WKi+ / password: 1ge1AVWsx~), not\nconfigurable by administrators\n\n3. Unrestricted sudo for the tomcat user \u2014 passwordless gdb with an\nattacker-controlled command file in /tmp, plus three additional\nindependent root escalation paths (systemctl, PYTHONPATH, LD_PRELOAD)\n\n## Impact\n\nRoot access to CUCM grants: interception of all voice communications\nvia SRTP key extraction, silent activation of built-in CALEA-compliant\nlawful intercept wiretapping, access to all voicemail, complete CDR\nexfiltration, call routing manipulation, E911 disruption, and lateral\nmovement into the voice VLAN.\n\nCUCM is deployed in Fortune 500 companies, US federal agencies, the\nDepartment of Defense, hospitals, financial institutions, law\nenforcement, and telecommunications providers worldwide.\n\n## Quick Test\n\ncurl -sk -H \"X-Forwarded-For: 127.0.0.1\" \\\n-u \u00271mJdd4WKi+:1ge1AVWsx~\u0027 \\\n\"https://TARGET:443/manager/text/list\";\n\nIf the response begins with \"OK - Listed applications for virtual\nhost [localhost]\" \u2014 the system is vulnerable.\n\n## Vendor Coordination\n\n- 17 CUCM submissions to ZDI \u2014 unprocessed\n- SSD paused CUCM acquisitions (Cisco won\u0027t fix existing reports)\n- Cisco PSIRT contacted 2026-08-04 \u2014 no response\n- MITRE CVE IDs requested (CNA of Last Resort) \u2014 pending\n\nThis is advisory 1 of 55 identified vulnerabilities in CUCM 15.x.\n\n## References\n\nFull advisory: https://github.com/0xReadingSteiner/Silent-Call\nPoC script: https://github.com/0xReadingSteiner/Silent-Call/blob/main/poc.sh\nMaster index: https://github.com/0xReadingSteiner/cisco-security-research\n\n## Disclosure Statement\n\nThis research was conducted independently on commercially available\nsoftware in a private laboratory. No proprietary source code, internal\ntools, or confidential information was used. Coordination was attempted\nthrough three independent channels before publication.\n\nAdditional findings will be published on a rolling basis.\n\n0xReadingSteiner\n0xReadingSteiner@proton.mePGP: D5E22255F645A8B935056C278C0958C5D533080A\n\nSent with [Proton Mail](https://proton.me/mail/home) secure email.\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-644",
"description": "CWE-644",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-798",
"description": "CWE-798",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T09:21:50Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/0"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Aug/0"
},
{
"url": "https://TARGET:443/manager/text/list\""
},
{
"url": "https://github.com/0xReadingSteiner/Silent-Call"
},
{
"url": "https://github.com/0xReadingSteiner/Silent-Call/blob/main/poc.sh"
},
{
"url": "https://github.com/0xReadingSteiner/cisco-security-research"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://proton.me/mail/home"
},
{
"url": "https://seclists.org/fulldisclosure/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Aug/0"
],
"discovery": "EXTERNAL"
},
"title": "Silent;Call \u2014 Pre-Authentication Remote Root in Cisco CUCM 15.x (SKYLINE-2026-001/002/003)",
"x_gcve": [
{
"recordType": "analysis",
"relationships": [
{
"destId": "SKYLINE-2026-001",
"type": "possibly_related"
},
{
"destId": "SKYLINE-2026-002",
"type": "possibly_related"
},
{
"destId": "SKYLINE-2026-003",
"type": "possibly_related"
}
],
"vulnId": "GCVE-1988-2026-0016",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/0",
"automated": true,
"contentSha256": "a7cad29433e49b5bfa49c4134ecd3ef9b6f1067f706eae3ecd6d455a1c000656",
"evidenceScore": 10,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/0",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-04T20:35:28Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0016"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-07T09:21:50Z",
"dateUpdated": "2026-09-07T09:21:50Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0016"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation MIT-1
Architecture and Design
Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Mitigation MIT-48
Architecture and Design
Strategy: Separation of Privilege
Follow the principle of least privilege when assigning access rights to entities in a software system.
Mitigation MIT-49
Architecture and Design
Strategy: Separation of Privilege
Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.
CAPEC-122: Privilege Abuse
An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources.
CAPEC-233: Privilege Escalation
An adversary exploits a weakness enabling them to elevate their privilege and perform an action that they are not supposed to be authorized to perform.
CAPEC-58: Restful Privilege Elevation
An adversary identifies a Rest HTTP (Get, Put, Delete) style permission method allowing them to perform various malicious actions upon server data due to lack of access control mechanisms implemented within the application service accepting HTTP messages.