CVE-2026-19681

CriticalCVSS 9.9/10Last modified Aug 19, 2026

Description

An authenticated command injection vulnerability exists in Security Center related to file upload processing. An attacker could exploit this issue by uploading a specially crafted file, potentially resulting in arbitrary command execution on the underlying operating system.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Aug 14, 2026
Last modified: Aug 19, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-196829.9A command injection vulnerability exists in Security Center where a remote, unauthenticated attacker could exploit this issue to execute arb CVE-2026-196837.4A vulnerability exists in the Dynamic DNS (DDNS) functionality of TP-Link Omada Gateways. During communication with a third-party DDNS servi CVE-2026-196857.1NetworkManager did not apply the private_user restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. T CVE-2026-19695.3The trx_addons WordPress plugin before 2.38.5 does not correctly validate file types in one of its AJAX action, allowing unauthenticated use CVE-2026-196938.1extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component,CVE-2026-196945.5TTX Logger file parser crash in 4.6.0 to 4.6.7 allows denial of service CVE-2026-196955.5Gammu DCT3 trace file parser crash in 4.6.0 to 4.6.7 allows denial of service CVE-2026-196965.5Ixia IxVeriWave and Vector Informatik BLF file parser crashes in 4.6.0 to 4.6.7 allows denial of service on Windows CVE-2026-196976.8The GutenKit WordPress plugin before 2.5.0 does not sanitise uploaded SVG files on all of the upload paths it enables, allowing users with CVE-2026-196983.5The GutenKit WordPress plugin before 2.5.1 does not validate or escape style settings saved against a post before using them to build the CS CVE-2026-196992.7The GutenKit WordPress plugin before 2.5.0 does not have a sufficient capability check on some of its REST API endpoints, allowing users wi CVE-2026-19706.1A flaw has been found in Edimax BR-6258n up to 1.18. This issue affects the function formStaDrvSetup of the file /goform/formStaDrvSetup. Th