CVE-2026-33924
High · 7.2CVSS
7.2
EPSS
1.1%
Published
Oct 29, 2026
CISA due date
—
The record
Two OS command injection vulnerabilities were discovered in the update installation functionality due to insufficient validation of the update bundle contents. An attacker with administrative privileges can remotely supply a crafted update bundle that, when installed, causes arbitrary commands to be executed with root privileges, allowing the attacker to read or modify sensitive data, change the appliance configuration, or shut down the appliance.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-62853 ThingLinks is an enterprise IoT platform. CWE-78
- CVE-2026-119335 Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing… CWE-78
- CVE-2026-116241 pgAdmin 4's Import/Export Data tool wraps a user's query export in a psql \copy (...) TO… CWE-78
- CVE-2026-119713 Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerability… CWE-78
- CVE-2026-119288 Zuke is a code-first, strongly typed build automation system for Deno. CWE-78
- CVE-2026-118238 The Tenda W18E web management server is vulnerable to OS command injection via the… CWE-78
- CVE-2026-91913 Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization… CWE-78
- CVE-2026-118992 CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell… CWE-78