CVE-2026-20468
MediumCVSS 6.0Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
In the apusys component, there is a possible escalation of privilege due to a confused deputy. This could lead to local escalation of privilege if an attacker already has System privilege. User interaction is not required for exploitation.
Risk Assessment
An attacker with System privileges could exploit this to gain higher privileges, potentially leading to full system control.
Recommendation
Apply patch AUTO00833804 to fix the vulnerability.
Other vulnerabilities in apusys
See all- CVE-2026-20542Unknown
In the apusys component, there is a possible memory corruption due to use after free. This could lead to local privilege escalation if a malicious actor has already obtained System privilege. User interaction is not needed for exploitation.
- CVE-2026-20467Medium
In the apusys component, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege if an attacker already has System privilege. User interaction is not required for exploitation.
Original NVD description (English source)
In apusys, there is a possible escalation of privilege due to a confused deputy. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: AUTO00833804; Issue ID: MSV-6741.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS