Vulnerability · Published Feb 15, 2026 · Assigned by VulnCheck

CVE-2026-26369JUNG eNet SMART HOME server 2.2.1/2.3.1 Privilege Escalation via setUserGroup

High 8.8

In plain English

A high-severity privilege mismanagement in eNet SMART HOME server from JUNG. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.6%top 50.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

eNet SMART HOME server 2.2.1 and 2.3.1 contains a privilege escalation vulnerability due to insufficient authorization checks in the setUserGroup JSON-RPC method. A low-privileged user (UG_USER) can send a crafted POST request to /jsonrpc/management specifying their own username to elevate their account to the UG_ADMIN group, bypassing intended access controls and gaining administrative capabilities such as modifying device configurations, network settings, and other smart home system functions.

Affected products (as reported)

Vendor	Product	Versions
JUNG	eNet SMART HOME server	2.3.1 (46841)2.2.1 (46056)

Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

ZeroScience Vulnerability Advisory ZSL-2026-5975 third-party-advisory
VulnCheck Advisory: JUNG eNet SMART HOME server 2.2.1/2.3.1 Privilege Escalation via setUserGroup third-party-advisory