CVE-2026-9651
MediumCVSS 4.4Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
CWE-732 Incorrect Permission Assignment for Critical Resource vulnerability could cause unauthorized disclosure of password hashes. An attacker with privileged local access can read improperly protected system files, potentially leading to account compromise.
Risk Assessment
The risk involves theft of password hashes by a privileged local attacker, which could lead to privilege escalation and account takeover within the organization.
Recommendation
Immediately update the system to a patched version and verify/correct permissions on system files storing password hashes.
Other vulnerabilities in System
See all- CVE-2026-22909High
Certain system functions may be accessed without proper authorization, allowing attackers to start, stop, or delete installed applications, potentially disrupting system operations.
- CVE-2026-49190High
The system fails to evaluate instructional permissions over multiple internal operation codes (opcodes), permitting unauthorized application installations or command executions.
- CVE-2023-35691High
There is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service with System execution privileges needed.
Original NVD description (English source)
CWE-732 Incorrect Permission Assignment for Critical Resource vulnerability that could cause unauthorized disclosure of password hashes and potential account compromise when an attacker with privileged local access reads improperly protected system files.