CVE-2026-9645
CriticalCVSS 9.9Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
The vulnerability allows authenticated users to create and execute arbitrary JavaScript code on the server. Scripts run with full privileges, enabling complete system compromise as commands are executed as root.
Risk Assessment
The risk for the organization is critical – an attacker with a user account can gain full control over the server, leading to data theft, system modification, or service disruption.
Recommendation
Immediately block access to the exposed methods for unauthorized users and apply the security patch from the vendor. Additionally, restrict script execution privileges and implement activity monitoring.
Original NVD description (English source)
Exposed methods allow authenticated users to create and execute arbitrary JavaScript code on the server. The scripts execute with full access, enabling complete system compromise as commands are executed as root.