CVE-2026-19635
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
A local privilege escalation vulnerability exists in Security Center. An attacker with write access to a specific configuration file could achieve arbitrary code execution with elevated privileges, without requiring further user or victim interaction.
Risk Assessment
An attacker with local access could gain full control of the system, potentially leading to data integrity and confidentiality breaches.
Recommendation
Restrict permissions on configuration files and apply vendor patches to prevent privilege escalation.
Other vulnerabilities in Security Center
See all- CVE-2026-19682Critical
A command injection vulnerability in Security Center allows a remote, unauthenticated attacker to execute arbitrary commands on the underlying operating system with the privileges of the service account.
- CVE-2026-19681Critical
An authenticated command injection vulnerability in Security Center related to file upload processing allows an attacker to execute arbitrary commands on the underlying operating system by uploading a specially crafted file.
- CVE-2026-19680High
A SQL injection vulnerability exists in Security Center that could allow an attacker to access unauthorized data from the application's database.
- CVE-2026-19679High
An input validation vulnerability exists in Security Center's file upload handling, where insufficient sanitization of uploaded filenames could contribute to a downstream command injection issue.
- CVE-2026-19639Medium
An improper access control vulnerability allows an authenticated non-administrative user to view settings outside their assigned scope.
- CVE-2026-19636Medium
CSRF tokens were generated using a predictable method, reducing their effectiveness. This has been addressed by improving randomness and entropy of token generation.
- CVE-2026-19631Medium
A SQL injection vulnerability in Security Center allows an authenticated administrator to execute arbitrary SQL queries, potentially leading to unauthorized access to sensitive data, including credentials.
Original NVD description (English source)
A local privilege escalation vulnerability exists in Security Center. An attacker with write access to a specific configuration file could achieve arbitrary code execution with elevated privileges, without requiring further user or victim interaction.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS