CVE-2026-19682

CriticalCVSS 9.9/10Last modified Aug 19, 2026

Description

A command injection vulnerability exists in Security Center where a remote, unauthenticated attacker could exploit this issue to execute arbitrary commands on the underlying operating system with the privileges of the service account.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Aug 14, 2026
Last modified: Aug 19, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-196837.4A vulnerability exists in the Dynamic DNS (DDNS) functionality of TP-Link Omada Gateways. During communication with a third-party DDNS servi CVE-2026-196857.1NetworkManager did not apply the private_user restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. T CVE-2026-19695.3The trx_addons WordPress plugin before 2.38.5 does not correctly validate file types in one of its AJAX action, allowing unauthenticated use CVE-2026-196938.1extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component,CVE-2026-196945.5TTX Logger file parser crash in 4.6.0 to 4.6.7 allows denial of service CVE-2026-196955.5Gammu DCT3 trace file parser crash in 4.6.0 to 4.6.7 allows denial of service CVE-2026-196965.5Ixia IxVeriWave and Vector Informatik BLF file parser crashes in 4.6.0 to 4.6.7 allows denial of service on Windows CVE-2026-196976.8The GutenKit WordPress plugin before 2.5.0 does not sanitise uploaded SVG files on all of the upload paths it enables, allowing users with CVE-2026-196983.5The GutenKit WordPress plugin before 2.5.1 does not validate or escape style settings saved against a post before using them to build the CS CVE-2026-196992.7The GutenKit WordPress plugin before 2.5.0 does not have a sufficient capability check on some of its REST API endpoints, allowing users wi CVE-2026-19706.1A flaw has been found in Edimax BR-6258n up to 1.18. This issue affects the function formStaDrvSetup of the file /goform/formStaDrvSetup. Th CVE-2026-197027.8Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TÜBİTAK BİLGEM Software Technolo