CVE-2026-50602

HighCVSS 8.5/10Last modified Sep 3, 2026

Description

A security vulnerability has been identified in Planet9 due to incorrect file permissions assigned to an application executable used by the Planet9 background service. The service runs with SYSTEM privileges, while the affected executable grants excessive permissions to non-administrative users. As a result, an authenticated local user could potentially modify or replace the executable and execute arbitrary code with SYSTEM privileges when the service starts or the system is restarted.

Metrics

CVSS 4.0 8.5/10CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-732

Affected software

No affected versions have been published.

Timeline

Published
Aug 17, 2026
Last modified
Sep 3, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-506034.9A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. The vulnerability is cauCVE-2026-506044.9A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. The socket handshake proCVE-2026-506057.4A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. Insufficient access contCVE-2026-506061.2A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. The vulnerability isCVE-2026-506072.7A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. A WebSocket service CVE-2026-506081.2A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. The WebSocket handshCVE-2026-506097.4A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. Insufficient access CVE-2026-50614.7The consul-template library before version 0.42.0 is vulnerable to a sandbox path bypass in the file template helper that may allow reading CVE-2026-506107.4A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense due to insufficient aCVE-2026-506129.4An unix symbolic link (symlink) following vulnerability has been reported to affect QuMagie. If a remote attacker gains a user account, theyCVE-2026-506199.3A path traversal vulnerability has been reported to affect Qsirch. If exploited, the vulnerability could allow remote attackers to read the CVE-2026-50624.9The PrettyLinks – Affiliate Links, Link Branding, Link Tracking, Marketing and Stripe Payments Plugin plugin for WordPress is vulnerable to
CVE-2026-50602: High severity, CVSS 8.5 | Vulnix