CVE-2026-88941

MediumCVSS 5.2/10Last modified Oct 29, 2026

Description

Kaspersky has fixed a vulnerability in the Network Agent for Windows module of Kaspersky Security Center. The vulnerability could potentially cause the Network Agent module of Kaspersky Security Center to malfunction. There are no evidence of the vulnerability exploitation in-the-wild.

Metrics

CVSS 3.1 5.2/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L

Weakness enumeration

CWE-306

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Kaspersky	Network Agent	16.3.0.1207; 16.2.0.1477; 16.2.0.1023; 16.2.0.917; 16.1.0.6517; 16.0.0.254; 15.4.0.8952; 15.3.0.392; 15.2.0.442; 15.1.0.20748; 15.1.0.11795; 14.0.0.20023; 10.5.1781
Kaspersky	Administration Server	15.1.0.22239; 15.1.0.20748

References

https://support.kaspersky.com/vulnerability/list-of-advisories/12430#291026

Timeline

Published: Oct 29, 2026
Last modified: Oct 29, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-889426.1The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'wpf_fid' JSON Parameter CVE-2026-889444.3The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to authorization bypass in all versions up to, and i CVE-2026-88956.4The kk blog card plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'blog-card' shortcode in all versions up CVE-2026-889529.1Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker to be signed in as another user by linking an OAu CVE-2026-889566.8The Botslab G980H dash camera firmware contains an authentication vulnerability in the root account exposed through the device's UART interf CVE-2026-889598.8Anchor CMS through 0.12.7 fails to enforce role-based access control in admin user-management endpoints, allowing any authenticated low-priv CVE-2026-88966.4The MIR blocks and shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' attribute (and other attribu CVE-2026-889628.8IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code CVE-2026-889636.1The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via the 'redirect_CVE-2026-889647.1An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denia CVE-2026-889677.7A user with query access to an Azure Monitor data source in Grafana can cause server-side requests to an attacker-controlled endpoint that d CVE-2026-889687.7Claude Code is an agentic coding tool. Prior to 2.1.251, the Edit tool validates a target using pathname and symlink resolution that is not