CVEvulnerability

CVE-2026-104018

8.8 HIGH Published 2026-10-01 Modified 2026-10-02 Official page ↗
Status
Awaiting Analysis
Published
2026-10-01
Last modified
2026-10-02
Assigner
0bf9931a-6ebf-4f48-bd14-39ee5e1d61f8
CVSS 3.1 (0bf9931a-6ebf-4f48-bd14-39ee5e1d61f8)
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-269

Description

An improper privilege management vulnerability (CWE-269) exists in the command shell of Wind River VxWorks 7 when configured to enforce per-user command privileges. Under certain shell operations, a command may be evaluated without the privilege check that is normally applied, allowing an authenticated user with limited privileges to execute commands they are not authorized to run. Successful exploitation can result in privilege escalation, with impact to the confidentiality, integrity, and availability of the affected device. The issue affects all versions of VxWorks 7 prior to 26.09.  It has been fixed in 26.09.

Related

Weakness · CWE (1)

  • CWE-269 Improper Privilege Management weakness

References