CVE-2026-8326
Remote Spark SparkView before build 1127 has a path traversal flaw that lets attackers read or write any file on the system as root, enabling remote code execution. The flaw is in the RDP drive redirection component and can be exploited without authentication. It is rated critical due to the full system compromise it allows.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Remote Spark SparkView before build 1127 (RDP drive redirection).
Real-world impact
An attacker can read or modify any file on the server, including system files, and execute arbitrary code with root privileges, potentially taking full control of the affected machine.
Why this severity
The CVSS score of 10 reflects that the vulnerability is exploitable remotely with no authentication, provides full control over the system, and has no mitigations or restrictions, making it a critical risk.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- May 29, 2026 · May 29, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 21, 2026 · 14d agoAdvisory updatedThe NVD record was last revised.