CVE-2026-94574

HighCVSS 7.8/10Last modified Sep 23, 2026

Description

A local cross-user code execution vulnerability exists in GNU wget (Windows builds from eternallybored.org) due to a hardcoded configuration file path (C:\msys64) that is writable by unprivileged users, allowing for arbitrary code execution via the use_askpass directive, potentially allowing local privilege escalation.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published
Sep 22, 2026
Last modified
Sep 23, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-945755.7A logic vulnerability in Brocade Fabric OS versions before 10.0.1 web management framework allows an authenticated, low-privileged user to bCVE-2026-945768.0An authentication logic and privilege escalation vulnerability exists in the account management interface of Brocade Fabric OS versions befoCVE-2026-945777.8A privilege escalation vulnerability exists in the internal Command-Line Interface (CLI) authorization handling mechanism of Brocade Fabric CVE-2026-945788.8Brocade Fabric OS versions before 10.0.1 contain an authorization logic vulnerability in the AAA (Authentication, Authorization, and AccountCVE-2026-945798.0An OS command injection vulnerability exists in the PAM (Pluggable Authentication Module) session cleanup routines during SSH session terminCVE-2026-94589.8A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. The impacted element is the function setWanCfg of the file /cgi-bin/CVE-2026-945804.5An arbitrary file and directory deletion vulnerability exists in the REST API management interface handling USB storage operations on BrocadCVE-2026-945816.8An OS command injection vulnerability exists in the REST API management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 thrCVE-2026-945827.8A memory buffer overflow vulnerability exists in the internal diagnostic and route validation routines used by the Fabric Shortest Path FirsCVE-2026-945832.6A race condition vulnerability exists in the request processing logic of the REST management interface on Brocade Fabric OS versions before CVE-2026-945842.6A race condition and thread-safety vulnerability exists in the web management daemon of Brocade Fabric OS versions before 10.0.1. When handlCVE-2026-945858.8An authentication bypass vulnerability exists in the web management interface of Brocade Fabric OS versions before 9.2.2d running on the MXG
CVE-2026-94574: High severity, CVSS 7.8 | Vulnix