CVE-2026-21140

MediumCVSS 6.9/10Last modified Oct 2, 2026

Description

Improper access control in ManagedProvisioning prior to SMR Sep-2026 Release 1 allows local attackers to install arbitrary applications.

Metrics

CVSS 4.0 6.9/10CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 2, 2026
Last modified
Oct 2, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-21159.8A flaw has been found in itsourcecode Society Management System 1.0. This issue affects some unknown processing of the file /admin/delete_exCVE-2026-21169.8A vulnerability has been found in itsourcecode Society Management System 1.0. Impacted is an unknown function of the file /admin/edit_expensCVE-2026-21179.8A vulnerability was found in itsourcecode Society Management System 1.0. The affected element is an unknown function of the file /admin/editCVE-2026-21187.2A vulnerability was determined in UTT HiPER 810 1.7.4-141218. The impacted element is the function sub_4407D4 of the file /goform/formReleasCVE-2026-21207.2A vulnerability was identified in D-Link DIR-823X 250416. This affects an unknown function of the file /goform/set_server_settings of the coCVE-2026-21214.4The Weaver Show Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'add_class' parameter in all versions up to,CVE-2026-212187.5Improper handling of missing special element in .NET allows an unauthorized attacker to perform spoofing over a network.CVE-2026-212197.0Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.CVE-2026-21229.8A security flaw has been discovered in Xiaopi Panel up to 20260126. This impacts an unknown function of the file /demo.php of the component CVE-2026-212217.0Concurrent execution using shared resource with improper synchronization ('race condition') in Capability Access Management Service (camsvc)CVE-2026-212225.5Insertion of sensitive information into log file in Windows Kernel allows an authorized attacker to disclose information locally.CVE-2026-212237.1Improper privilege management in Microsoft Edge (Chromium-based) allows an authorized attacker to bypass a security feature locally.
CVE-2026-21140: Medium severity, CVSS 6.9 | Vulnix