Vulnerability · Published Oct 1, 2026 · Assigned by WindRiver
CVE-2026-104018VxWorks 7 improper privilege management
High 8.8
In plain English
A high-severity privilege mismanagement in VxWorks 7 from Wind River Systems Inc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities).
Official description
An improper privilege management vulnerability (CWE-269) exists in the command shell of Wind River VxWorks 7 when configured to enforce per-user command privileges. Under certain shell operations, a command may be evaluated without the privilege check that is normally applied, allowing an authenticated user with limited privileges to execute commands they are not authorized to run. Successful exploitation can result in privilege escalation, with impact to the confidentiality, integrity, and availability of the affected device. The issue affects all versions of VxWorks 7 prior to 26.09. It has been fixed in 26.09.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Wind River Systems Inc | VxWorks 7 | VxWorks 7 |
Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H