PULSE
ES
FEED
ransomvexy ransomware reclama a System Soft · BG · Technologyransomvexy ransomware reclama a JHAMF Group · BDransomemperador reclama a Punta Shopping · BR · Retail & E-Commerceransomnightspire reclama a **F*A *.Aransompayload reclama a Straze Garden Center · Retail & E-Commerceransompayload reclama a Kraft Lernen · DE · Educationransompayload reclama a SALEG (Sachsen-Anhaltische Landesentwicklungsgesellschaft mbH) · DE · Government & Defenseransomrhysida reclama a Phoenix Charter Academy · US · Educationransomauditteam reclama a Pe***CT · NLransomauditteam reclama a jl***om · SGransomauditteam reclama a hn***rgransomauditteam reclama a ro***upransomsarcoma reclama a Ivan Smith Furniture · PH · Retail & E-Commerceransomwhitearmor reclama a Gamdom V2 · Otherransomvexy ransomware reclama a System Soft · BG · Technologyransomvexy ransomware reclama a JHAMF Group · BDransomemperador reclama a Punta Shopping · BR · Retail & E-Commerceransomnightspire reclama a **F*A *.Aransompayload reclama a Straze Garden Center · Retail & E-Commerceransompayload reclama a Kraft Lernen · DE · Educationransompayload reclama a SALEG (Sachsen-Anhaltische Landesentwicklungsgesellschaft mbH) · DE · Government & Defenseransomrhysida reclama a Phoenix Charter Academy · US · Educationransomauditteam reclama a Pe***CT · NLransomauditteam reclama a jl***om · SGransomauditteam reclama a hn***rgransomauditteam reclama a ro***upransomsarcoma reclama a Ivan Smith Furniture · PH · Retail & E-Commerceransomwhitearmor reclama a Gamdom V2 · Other
← All CVEs
CVE WatchSep 23, 2026

CVE-2026-49887

In maybeRemoveInvalidInstallerPackageName of InstallRepository.kt, there is a possible unauthorized app update due to a permissions bypass.

CVSS

7.8

High

EPSS

0.1%

p0

KEV

—

Exploit Today

0

0-100

Published: Sep 8, 2026 · Last modified: Sep 23, 2026 · CWE-288

EPSS · 30d
0.1%EPSS · 30 days0.1%
2026-10-032026-10-30
Technical description

In maybeRemoveInvalidInstallerPackageName of InstallRepository.kt, there is a possible unauthorized app update due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Official references
Related CVEs
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-115829—
—
——0In Secret Server versions earlier than 12.3.1, a user could bypass the initial login step and authenticate by successfully negotiating the second factor login step only.1dCVE-2026-1194208.8 HIG
—
——0Lago through 1.55.0 contains an authentication bypass vulnerability that allows organization administrators to obtain session tokens for existing accounts via the acceptInvite mutation without a password check. Attackers can invite a victim's email, accept with an arbitrary password, and receive a JWT to access the victim's organizations, billing data, API keys and payment integrations.1dCVE-2026-118582—
7.8%
——2Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA allows Functionality Bypass. This issue affects CAPTCHA versions: from 0.0.0 to 1.18.0, from 2.0.0 to 2.0.11.1dCVE-2026-118572—
7.8%
——2Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OAuth Login - OAuth OIDC SSO allows Authentication Bypass. This issue affects OAuth Login - OAuth OIDC SSO versions: from 0.0.0 to 3.1.1.1dCVE-2026-118554—
9.0%
——3Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect Client allows Authentication Bypass. This issue affects OpenID Connect Client versions: from 0.0.0 to 2.3.1.1dCVE-2026-1145725.4 MED
9.0%
——3Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Domain Login Restrict allows Authentication Bypass. This issue affects Domain Login Restrict versions: from 0.0.0 to 1.5.0.1d