CVE Watch8 sept 2026

CVE-2026-86665

A vulnerability was identified in aircheng-org iWebShop-5 up to 5.15. This issue affects the function Update::index of the file controllers/

CVSS

7.3

Alto

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 8 sept 2026 · Última mod.: 8 sept 2026 · CWE-862 · CWE-863

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

A vulnerability was identified in aircheng-org iWebShop-5 up to 5.15. This issue affects the function Update::index of the file controllers/update.php. The manipulation leads to missing authorization. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-839427.8 ALT

—

———Missing authorization in Windows Kernel allows an authorized attacker to elevate privileges locally.4h CVE-2026-839419.9 CRÍ

—

———Missing authorization in Entra ID allows an authorized attacker to elevate privileges over a network.4h CVE-2026-818235.3 MED

—

———The vulnerability, if exploited, could allow an unauthenticated miscreant to perform read operations intended only for PIMBoards users, resulting in information disclosure. Write operations are not impacted.4h CVE-2026-730147.8 ALT

—

———Missing authorization in Data Sharing Service Client allows an authorized attacker to elevate privileges locally.4h CVE-2026-729665.5 MED

—

———Missing authorization in Windows Remote Access Connection Manager allows an authorized attacker to perform tampering locally.4h CVE-2026-702837.0 ALT

—

———Incorrect authorization in Windows Win32K allows an authorized attacker to elevate privileges locally.4h