CVE-2026-9645
This vulnerability allows users with valid login credentials to run custom JavaScript code directly on a server. Because the code runs with the highest level of system authority, it can lead to a total takeover of the machine.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
No specific software or versions are listed in the provided data.
Real-world impact
An attacker with a standard user account could execute commands as the 'root' user, allowing them to steal data, modify files, or take full control of the entire system.
Why this severity
This is rated as critical because the vulnerability is easy to exploit remotely and provides the attacker with full administrative control over the affected system.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- May 28, 2026 · May 28, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 21, 2026 · 14d agoAdvisory updatedThe NVD record was last revised.