Vulnerability · Published May 29, 2026 · Assigned by NCSC.ch

CVE-2026-8326Remote Spark SparkView Path Traversal in RDP Drive Redirection leading to RCE

Critical 10.0

In plain English

A critical-severity security flaw in SparkView from Remote Spark (https://www.remotespark.com/). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).

Severity (CVSS 4.0)10.0Critical

Exploit odds (30 days)0.4%top 68.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Path traversal vulnerability in Remote Spark (https://www.Remotespark.Com/) SparkView allows reading and writing arbitrary files in all directories as root. This leads to RCE. The affected component is the RDP drive redirection. Depending on implementation, the vulnerability can be exploited by an unauthenticated attacker. This issue affects SparkView: before build 1127.

Affected products (as reported)

Vendor	Product	Versions
Remote Spark (https://www.remotespark.com/)	SparkView	0 – before build 1127

Weakness: CWE-23 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

https://www.remotespark.com/view/new.html release-notes