CVE-2026-2713

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

IBM Trusteer Rapport installer 3.5.2309.290 IBM Trusteer Rapport could allow a local attacker to execute arbitrary code on the system, caused by DLL uncontrolled search path element vulnerability. By placing a specially crafted file in a compromised folder, an attacker could exploit this vulnerability to execute arbitrary code on the system.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-427

Affected software

Vendor	Product	Versions
IBM	Trusteer Rapport installer	3.5.2309.290

References

https://www.ibm.com/support/pages/node/7263031Vendor Advisory

Timeline

Published: Mar 10, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-271309.9Dokploy is a free, self-hostable Platform as a Service (PaaS). Versions 0.26.6 and below have OS command injection through the appName param CVE-2026-271315.5The Sprig Plugin for Craft CMS is a reactive Twig component framework for Craft CMS. Starting in version 2.0.0 and prior to versions 2.15.2 CVE-2026-271335.9Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. From 0.47.0 to before CVE-2026-271348.1Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In versions 0.49.0 t CVE-2026-271357.5nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading t CVE-2026-271366.1Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attac CVE-2026-271377.5When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local porti CVE-2026-271385.9Certificate verification can panic when a certificate in the chain has an empty DNS name and another certificate in the chain has excluded n CVE-2026-271392.5On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file CVE-2026-27144.4The Institute Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Enquiry Form Title' setting in all versi CVE-2026-271408.8SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to tr CVE-2026-271417.5Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic