CVE-2026-19680

A command injection vulnerability in Security Center allows a remote, unauthenticated attacker to execute arbitrary commands on the underlying operating system with the privileges of the service account.

An authenticated command injection vulnerability in Security Center related to file upload processing allows an attacker to execute arbitrary commands on the underlying operating system by uploading a specially crafted file.

An input validation vulnerability exists in Security Center's file upload handling, where insufficient sanitization of uploaded filenames could contribute to a downstream command injection issue.

An improper access control vulnerability allows an authenticated non-administrative user to view settings outside their assigned scope.

CSRF tokens were generated using a predictable method, reducing their effectiveness. This has been addressed by improving randomness and entropy of token generation.

A local privilege escalation vulnerability exists in Security Center. An attacker with write access to a specific configuration file could achieve arbitrary code execution with elevated privileges, without requiring further user or victim interaction.

A SQL injection vulnerability in Security Center allows an authenticated administrator to execute arbitrary SQL queries, potentially leading to unauthorized access to sensitive data, including credentials.