CVE-2026-9158

CriticalCVSS 9.8/10Last modified Jul 2, 2026

Description

In Eclipse 4diac FORTE versions 3.0.0 to 3.1.0, a specially crafted DELETE connection command to the management interface can lead to a dangling pointer. This allows subsequent commands to access freed memory (use-after-free).

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

No affected versions have been published.

Timeline

Published
Jun 18, 2026
Last modified
Jul 2, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-915823.7Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Search). The supported verCVE-2026-915886.5Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Search). Supported versionsCVE-2026-915905.4Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Service API). Supported versions that are affected areCVE-2026-915978.3Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). Supported CVE-2026-915984.3Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Majel Mobile Service). SupportCVE-2026-91604.3Improper neutralization of special elements used in a template engine vulnerability in Arma Digital Media Inc. Website Template allows Code CVE-2026-916004.3Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Visual Analyzer). The supportCVE-2026-916047.5Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality ManageCVE-2026-916074.3Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server). Supported vCVE-2026-916087.5Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). Supported versions that are affected are 8.2.CVE-2026-916096.5Vulnerability in Oracle REST Data Services (component: Graph QL). Supported versions that are affected are 24.2.0-26.2.1. Easily exploitablCVE-2026-91615.3Observable response discrepancy vulnerability in DernekPlus Website Template allows Account Footprinting. This issue affects Website Templa
CVE-2026-9158: Critical severity, CVSS 9.8 | Vulnix