Vulnerability · Published Sep 16, 2026 · Assigned by certcc
CVE-2026-90999Sentry Seer vulnerability allows attacker-controlled input to be executed in a privileged environment
Critical 9.8
In plain English
A critical-severity improper input validation in Sentry Seer from Functional Software, Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).
Official description
Sentry Seer is vulnerable to a multi-stage trust-boundary violation that allows unauthenticated attacker-controlled telemetry to become code that is executed by an agent in a privileged automation environment. An external attacker can submit fabricated Sentry events without having access to the victim’s Sentry account, source repository, or infrastructure.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Functional Software, Inc. | Sentry Seer | Web site |
Weakness: CWE-20, CWE-74, CWE-116, CWE-94, CWE-913 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H