CVE-2026-34927

HighCVSS 7.8/10Last modified Jul 23, 2026

Description

An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-346

Affected software

No affected versions have been published.

Timeline

Published
May 21, 2026
Last modified
Jul 23, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-349287.8An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. CVE-2026-349297.8An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. CVE-2026-349307.8An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. CVE-2026-349319.6hoppscotch is an open source API development ecosystem. Prior to version 2026.3.0, there is an open redirect vulnerability that leads to tokCVE-2026-349329.3hoppscotch is an open source API development ecosystem. Prior to version 2026.3.0, there is a stored XSS vulnerability that can lead to CSRFCVE-2026-349335.5Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. Prior to version 0.9-rc4, any uCVE-2026-349349.8PraisonAI is a multi-agent teams system. Prior to version 4.5.90, the get_all_user_threads function constructs raw SQL queries using f-strinCVE-2026-349359.8PraisonAI is a multi-agent teams system. From version 4.5.15 to before version 4.5.69, the --mcp CLI argument is passed directly to shlex.spCVE-2026-349367.7PraisonAI is a multi-agent teams system. Prior to version 4.5.90, passthrough() and apassthrough() in praisonai accept a caller-controlled aCVE-2026-349379.8PraisonAI is a multi-agent teams system. Prior to version 1.5.90, run_python() in praisonai constructs a shell command string by interpolatiCVE-2026-3493810.0PraisonAI is a multi-agent teams system. Prior to version 1.5.90, execute_code() in praisonai-agents runs attacker-controlled Python inside CVE-2026-349397.5PraisonAI is a multi-agent teams system. Prior to version 4.5.90, MCPToolIndex.search_tools() compiles a caller-supplied string directly as
CVE-2026-34927: High severity, CVSS 7.8 | Vulnix