CVE-2026-66890

CriticalCVSS 9.6/10Last modified Sep 18, 2026

Description

The affected products use hard-coded credentials, which could allow remote access to files with root privileges where FTP is reachable.

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-798

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Sep 15, 2026
Last modified
Sep 18, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-668979.9A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launchiCVE-2026-668989.9A path traversal vulnerability in LXD allows an attacker to manipulate file system paths during backup import and restore operations. When iCVE-2026-66907.2The LifePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'n' parameter of the lp_update_mds AJAX action in alCVE-2026-669017.5Google::Auth versions before 0.09 for Perl allow server side request forgery and credential exfiltration via unvalidated URLs taken from theCVE-2026-669029.8Google::Auth versions before 0.06 for Perl run a command named in an external_account credentials JSON via an ungated system call. The PlugCVE-2026-669069.1Relative path traversal vulnerability in Apache Camel Azure Storage Blob component. This issue affects Apache Camel: from 4.0.0 before 4.CVE-2026-669077.5Relative path traversal vulnerability in Apache Camel Google Storage component. This issue affects Apache Camel: from 4.0.0 before 4.14.9CVE-2026-669087.5Improper Authentication vulnerability in Apache Camel Platform HTTP Main component. This issue affects Apache Camel: from 4.8.0 before 4.CVE-2026-669099.8Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictioCVE-2026-66917.8The MongoDB C Driver's Cyrus SASL integration performs unsafe string copying during username canonicalization, enabling a heap buffer overflCVE-2026-669136.9Lookyloo did not enforce limits on the decompressed size of uploaded capture archives and compressed HAR files. An attacker could submit a CVE-2026-669149.2Joomla Extension - seblod.com - Unauthenticated path traversal in SEBLOD < 3.30.0, < 4.7.0, < 6.0.1 - An unauthenticated attacker could down
CVE-2026-66890: Critical severity, CVSS 9.6 | Vulnix