CVE-2026-83524

CriticalCVSS 9.9/10Last modified Sep 1, 2026

Description

A security vulnerability has been detected in RedPort Optimizer wXa-203, Optimizer wXa-213 and Optimizer wXa-223 up to 20260704. This impacts the function exec of the file /xgatev1/system/datetime.php of the component System Clock. The manipulation leads to command injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published
Aug 31, 2026
Last modified
Sep 1, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-835268.8The FV Player 8 plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 8.1.7 via the check_mimetyCVE-2026-835278.1An Authentication Bypass vulnerability in Sentry before R10.8.2, R10.7.3 and R10.6.4 allows a remote unauthenticated attacker to gain adminiCVE-2026-83534.8Concrete CMS version 9.0 to 9.5.0 is vulnerable to Stored XSS via page name in the Atomik theme. A rogue editor can inject arbitrary JavaScrCVE-2026-835304.3A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit() configured on the CEL environment, andCVE-2026-835318.8Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Special Elements used in an Expression Language StatemCVE-2026-835326.8The Custom Menu Wizard Widget WordPress plugin through 3.3.1 does not sanitize and escape several shortcode attributes before rendering themCVE-2026-835335.3The WP Express Checkout WordPress plugin before 2.4.9 does not verify server-side that a payment was actually completed before marking an orCVE-2026-835346.4PostgreSQL Anonymizer contains a vulnerability in the anon.anonymize_database_parallel() function that allows the owner of a table to run arCVE-2026-835357.4A flaw was found in openstack-network-exporter. When an operator configures user authentication but omits or misconfigures Transport Layer SCVE-2026-835365.3A flaw was found in openstack-network-exporter. The HTTP server within the component is configured without essential timeout settings, such CVE-2026-835375.3The WP Express Checkout WordPress plugin before 2.5.0 does not verify server-side that a payment was actually completed before marking an orCVE-2026-83546.4The Gum Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pop_tag' parameter in all versions up
CVE-2026-83524: Critical severity, CVSS 9.9 | Vulnix