CVE-2026-89040

Awaiting Analysis Awaiting Analysis - Queue

Tencent MSEC Remote Code Execution via Directory Traversal

Publication date: 2026-09-15

Last updated on: 2026-09-22

Assigner: Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government

Description

Tencent Mass Service Engine in Cluster (MSEC) allows a remote, unauthenticated attacker to send a crafted POST request including ../ and gain root access on the target device. An attacker who uploads a webshell can execute arbitrary code as root.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-22

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-89040

EUVD

EUVD-2026-79672

Affected Vendors & Products

Vendor	Product	Version / Range
tencent	mass_service_engine	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

CVE-2026-89040 is a vulnerability in Tencent Mass Service Engine in Cluster (MSEC) that allows a remote, unauthenticated attacker to send a crafted POST request with directory traversal sequences (../) to gain root access on the target device. An attacker can upload a webshell to execute arbitrary code as root.

Detection Guidance

Detecting this vulnerability requires checking for unauthorized root access or webshell uploads on systems running Tencent MSEC. Inspect network traffic for POST requests containing '../' patterns targeting MSEC endpoints. Review system logs for unexpected root-level processes or file modifications in MSEC directories. Use commands like 'ps aux | grep root' to check for suspicious processes and 'find / -name '*.jsp' -o -name '*.php' 2>/dev/null' to locate webshells.

Impact Analysis

This vulnerability allows attackers to gain full control over the affected system as root. This could lead to complete compromise of the device, unauthorized access to sensitive data, installation of malware, or disruption of services. Systems running vulnerable versions of MSEC are at high risk.

Compliance Impact

This vulnerability could lead to unauthorized access and exposure of sensitive data, violating GDPR and HIPAA requirements for data protection and access control. Organizations using vulnerable MSEC instances may face compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Immediately restrict network access to MSEC services, update to the latest patched version if available, and monitor for unauthorized root access or webshell uploads.

Hi! I’m here to help you understand CVE-2026-89040. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70