CVE-2026-83497

HighCVSS 8.8/10Last modified Sep 3, 2026

Description

Unrestricted deserialization of untrusted data in the cursor pagination component in the OpenSearch SQL plugin allows a remote authenticated user with basic read/search permissions to execute arbitrary code on the server by sending a crafted cursor parameter to the plugins/sql endpoint.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Aug 31, 2026
Last modified
Sep 3, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-834987.8Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locCVE-2026-834997.8Insufficient granularity of access control in Windows Server Update Service allows an authorized attacker to elevate privileges locally.CVE-2026-83508.8Concrete CMS 9.5.0 and below is vulnerable to missing authorization in the bulk_user_assignment.php which can lead to privilege escalation tCVE-2026-835006.1Url redirection to untrusted site ('open redirect') in Windows BitLocker allows an unauthorized attacker to bypass a security feature with aCVE-2026-835015.5Out-of-bounds read in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to disclose information locally.CVE-2026-835044.7Time-of-check time-of-use (toctou) race condition in Windows SmartScreen allows an authorized attacker to disclose information locally.CVE-2026-835057.0Time-of-check time-of-use (toctou) race condition in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locallyCVE-2026-835067.8Untrusted search path in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.CVE-2026-835075.5Improper link resolution before file access ('link following') in Windows Update Orchestrator Service allows an authorized attacker to disclCVE-2026-835087.8Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.CVE-2026-835097.0Untrusted search path in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.CVE-2026-83516.4The RTMKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Advanced Heading widget's 'Background Text' parameter i
CVE-2026-83497: High severity, CVSS 8.8 | Vulnix