CVE-2026-102117

Received Received - Intake

Authenticated System Administrator Exploits Remote Support for RCE

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government

Description

On deployments where the remote-support capability is licensed and enabled, an authenticated System Administrator who also possessed the key protecting the submitted data could redirect the underlying system's outbound support connection to a destination of their choosing. That destination could then have operating-system commands executed on the node and receive their output, potentially resulting in remote code execution with the privileges of a local service account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-30

Last Modified

2026-09-30

Generated

2026-10-01

AI Q&A

2026-10-01

EPSS Evaluated

N/A

NVD

CVE-2026-102117

EUVD

EUVD-2026-90302

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-807	The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.
CWE-940	The product establishes a communication channel to handle an incoming request that has been initiated by an actor, but it does not properly verify that the request is coming from the expected origin.

Attack-Flow Graph

Executive Summary

This vulnerability allows an authenticated System Administrator with specific access to redirect the system's outbound support connection to a chosen destination. The attacker could then execute operating-system commands on the node and receive their output, potentially leading to remote code execution with the privileges of a local service account.

Detection Guidance

Detection requires checking for unauthorized redirection of outbound support connections. Monitor network traffic for unexpected connections to external destinations from licensed remote-support systems. Inspect logs for commands executed by service accounts without proper authentication. Verify configuration files for remote-support settings and ensure only authorized destinations are allowed.

Impact Analysis

An attacker could gain control over the system, execute arbitrary commands, and access sensitive data or perform actions with the privileges of a local service account. This could lead to data breaches, system compromise, or further network infiltration.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements such as GDPR (data protection) and HIPAA (health information privacy). Organizations may face legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Disable the remote-support capability if licensed and enabled. Ensure the key protecting submitted data is not accessible to unauthorized users. Restrict System Administrator privileges to prevent misuse of the redirection feature.

Hi! I’m here to help you understand CVE-2026-102117. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70