CVE-2026-92088

HighCVSS 8.6/10Last modified Oct 13, 2026

Description

Improper handling of undefined values vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Escalation.

This issue affects upKeeper Instant Privilege Access: through 1.7.1.

Metrics

CVSS 4.0 8.6/10

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-232

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
upKeeper Solutions	upKeeper Instant Privilege Access	<= 1.7.1

References

https://support.upkeeper.se/hc/en-us/articles/31019905229084-CVE-2026-92088-Improper-handling-of-undefined-values

Timeline

Published: Oct 13, 2026
Last modified: Oct 13, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-92099.8mJobTime through build 15.7.3.32 contains an unauthenticated SQL execution vulnerability in the Login.aspx admin panel handlers, where the r CVE-2026-920915.9A flaw was found in jwcrypto. The JWK.import_key() function validates the key_ops JWK member for duplicate values using an algorithm with O(CVE-2026-920927.4A flaw was found in openshift-ansible. The installer container's `run` script downloads and executes remote inventory and dynamic scripts wi CVE-2026-920979.1The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44 Th CVE-2026-920986.1The Webheadcoder Multi-Step Forms for Contact Form 7 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'l10n_prin CVE-2026-920996.5The WPGraphQL Smart Cache WordPress plugin before 2.3.2 does not require authorisation or validate a caller-supplied query identifier before CVE-2026-92104.5Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network CVE-2026-921036.3Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a malicious HTTP/2 server to make the client h CVE-2026-921062.3Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dashbitco lazy_html allows mutation XS CVE-2026-92118.8An unauthenticated user on the local network can gain control of the router and make unauthorized changes to its operation.CVE-2026-921145.3A vulnerability was identified in a2ui-project a2ui up to 0.10.6. Affected is an unknown function of the file renderers/web_core/src/v0_9/ba CVE-2026-921158.8The WP Photo Album Plus plugin for WordPress is vulnerable to authenticated Command Injection in all versions up to, and including, 9.3.02.0