CVE-2026-4786

HighCVSS 7.1/10Last modified Aug 13, 2026

Description

Mitgation of CVE-2026-4519 was incomplete. If the URL contained "%action" the mitigation could be bypassed for certain browser types the "webbrowser.open()" API could have commands injected into the underlying shell. See CVE-2026-4519 for details.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L

Weakness enumeration

CWE-77 CWE-88

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Apr 13, 2026
Last modified: Aug 13, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-478606.5An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a s CVE-2026-478616.3An unauthenticated remote attacker who can send a single UDP packet to a Spring Integration UDP inbound adapter can cause the server to emit CVE-2026-478625.4An attacker who can set the file_name header on a message reaching a ZipTransformer with ZipResultType.FILE (the default) can cause the resu CVE-2026-478637.5In Reactor Core, applications that use the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (CVE-2026-478649.8SerializingHttpMessageConverter deserializes the body of incoming HTTP requests with a raw java.io.ObjectInputStream and no class filtering.CVE-2026-478659.8VMware Avi Load Balancer contains an authentication bypass vulnerability. A malicious user with network access may be able to access the Avi CVE-2026-478668.3VMware Avi Load Balancer contains an authorization bypass vulnerability. A malicious actor on the network can access a limited subset of the CVE-2026-478678.8VMware Avi Load Balancer contains a remote code execution vulnerability. A malicious user with network access may be able to access the Avi CVE-2026-478687.8VMware Avi Load Balancer contains a local privilege escalation vulnerability. A malicious user with local access may be able to escalate the CVE-2026-478698.8VMware Avi Load Balancer contains a remote code execution vulnerability. A malicious authenticated user with network access may be able to i CVE-2026-478708.8VMware Avi Load Balancer contains a privilege escalation vulnerability. A malicious authenticated user with network access may be able to ex CVE-2026-478718.8VMware Avi Load Balancer contains a directory traversal vulnerability. Flaws in file path validation allow malicious, authenticated network