CVE-2026-7849
An unauthenticated attacker can inject a command into a system configuration file that is then executed with root privileges. The flaw comes from improper handling of special characters, allowing arbitrary code execution. This could let a remote attacker take full control of the affected system.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Any product that fails to properly neutralize special elements in configuration files could be vulnerable. The typical user is a system administrator managing such systems.
Real-world impact
The attacker can run any command as root, effectively taking over the entire system, installing malware, exfiltrating data, or disrupting services.
Why this severity
The CVSS score of 9.3 reflects that the vulnerability is easily exploitable from the network, requires no authentication, and gives the attacker full control (high confidentiality, integrity, availability impact).
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources