CVE-2026-19631

A command injection vulnerability in Security Center allows a remote, unauthenticated attacker to execute arbitrary commands on the underlying operating system with the privileges of the service account.

An authenticated command injection vulnerability in Security Center related to file upload processing allows an attacker to execute arbitrary commands on the underlying operating system by uploading a specially crafted file.

A SQL injection vulnerability exists in Security Center that could allow an attacker to access unauthorized data from the application's database.

An input validation vulnerability exists in Security Center's file upload handling, where insufficient sanitization of uploaded filenames could contribute to a downstream command injection issue.

An improper access control vulnerability allows an authenticated non-administrative user to view settings outside their assigned scope.

CSRF tokens were generated using a predictable method, reducing their effectiveness. This has been addressed by improving randomness and entropy of token generation.

A local privilege escalation vulnerability exists in Security Center. An attacker with write access to a specific configuration file could achieve arbitrary code execution with elevated privileges, without requiring further user or victim interaction.