Vulnerability · Published Jul 5, 2026 · Assigned by VulDB
CVE-2026-14736Ruijie RG-UAC user_auth_commit.php unrestricted upload
High 7.3
In plain English
A high-severity unrestricted file upload in RG-UAC from Ruijie. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).
Severity (CVSS 3.1)7.3High
Exploit odds (30 days)0.5%top 59.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A vulnerability was found in Ruijie RG-UAC up to 1.0-R1.8.2.p5. The impacted element is an unknown function of the file user_auth_commit.php. Performing a manipulation of the argument upload_image results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made public and could be used.
Affected products (as reported)
Weakness: CWE-434, CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-376318 | Ruijie RG-UAC user_auth_commit.php unrestricted upload vdb-entry, technical-description
- VDB-376318 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- CVE-2026-14736 | CVE Analysis and Report third-party-advisory
- Submit #848624 | Beijing Star-Net Ruijie Network Technology Co., Ltd. RG-UAC V1.0-R1.8.2.p5 CWE-434 (Unrestricted Upload of File with Dangerous Type) third-party-advisory
- https://ucn9h68n9289.feishu.cn/wiki/OiAKwH3hRi3oVpkQyeycjjPrnL8?fromScene=spaceOverview exploit