CVE-2026-23648

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Glory RBG-100 recycler systems using the ISPK-08 software component contain multiple system binaries with overly permissive file permissions. Several binaries executed by the root user are writable and executable by unprivileged local users. An attacker with local access can replace or modify these binaries to execute arbitrary commands with root privileges, enabling local privilege escalation.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-732

Affected software

No affected versions have been published.

Timeline

Published
Feb 17, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-23657.2The Fluent Forms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `fluentform_step_form_save_data` AJAX action CVE-2026-236516.7Permissive regular expression in Azure Compute Gallery allows an authorized attacker to elevate privileges locally.CVE-2026-236529.8Improper neutralization of special elements used in a command ('command injection') in Microsoft Power Pages allows an unauthorized attackerCVE-2026-236536.5Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an authoCVE-2026-236548.8Dependency on vulnerable third-party component in GitHub Repo: zero-shot-scfoundation allows an unauthorized attacker to execute code over aCVE-2026-236556.5Cleartext storage of sensitive information in Azure Compute Gallery allows an authorized attacker to disclose information over a network.CVE-2026-236565.9Insufficient verification of data authenticity in Windows App Installer allows an unauthorized attacker to perform spoofing over a network.CVE-2026-236577.8Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.CVE-2026-236589.8Insufficiently protected credentials in Azure DevOps allows an unauthorized attacker to elevate privileges over a network.CVE-2026-236597.5Exposure of sensitive information to an unauthorized actor in Azure Data Factory allows an unauthorized attacker to disclose information oveCVE-2026-23663.1A flaw was found in Keycloak. An authorization bypass vulnerability in the Keycloak Admin API allows any authenticated user, even those withCVE-2026-236607.8Improper access control in Azure Portal Windows Admin Center allows an authorized attacker to elevate privileges locally.
CVE-2026-23648: High severity, CVSS 7.8 | Vulnix