CVE-2026-11846

HighCVSS 8.1/10Last modified Oct 25, 2026

Description

The iVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp has an Arbitrary File Deletion vulnerability, allowing authenticated remote attackers to exploit this vulnerability to delete arbitrary system files or directories, resulting in data destruction or service disruption.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
IEI Integration Corp	iVEC TANK-XM811	< 1.0.4

References

Timeline

Published: Jun 12, 2026
Last modified: Oct 25, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1184608.0Embedded private keys protected by a shared password can be used to sign practitioner assertions for arbitrary practitioner identifiers, ena CVE-2026-1184618.0The shared client accepts caller-controlled doctor identifiers for read and write operations without requiring authentication or authorizati CVE-2026-1184629.2Update components download and execute code without proper authenticity verification, relying on ignored hashes or forgeable checksums. Some CVE-2026-1184645.8Shared cryptographic services use fixed vendor-wide secrets, deterministic IVs, null salts, and reversible transformations to protect creden CVE-2026-1184655.8Shared components expose hard-coded Access, workgroup, CCBasic, DBISAM, and related database credentials that are identical across installat CVE-2026-1184674.3Shared telemetry and logging components store or transmit patient and doctor identifiers, clinical information, and low-entropy identifiers CVE-2026-1184687.2XML parsers process attacker-influenced update manifests or network responses with external entity resolution enabled, potentially allowing CVE-2026-118474.3The iVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp has a Path Traversal vulnerability, allowing authenticated rem CVE-2026-1184753.6A flaw was found in Eye of GNOME. When parsing a specially crafted PNG image containing malformed color profile metadata, the application fa CVE-2026-1184779.8The ei_git_repo_url parameter in the Git remote configuration endpoint of KaliFast is vulnerable to OS Command Injection. This OS Command In CVE-2026-1184785.4Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker CVE-2026-1184795.4Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipu