CVE-2026-104018
Received Received - Intake

Privilege Escalation in Wind River VxWorks Command Shell

Publication date: 2026-10-01

Last updated on: 2026-10-01

Assigner: WindRiver

Description
An improper privilege management vulnerability (CWE-269) exists in the command shell of Wind River VxWorks 7 when configured to enforce per-user command privileges. Under certain shell operations, a command may be evaluated without the privilege check that is normally applied, allowing an authenticated user with limited privileges to execute commands they are not authorized to run. Successful exploitation can result in privilege escalation, with impact to the confidentiality, integrity, and availability of the affected device. The issue affects all versions of VxWorks 7 prior to 26.09.  It has been fixed in 26.09.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-01
Last Modified
2026-10-01
Generated
2026-10-01
AI Q&A
2026-10-01
EPSS Evaluated
N/A
NVD
CVE-2026-104018
EUVD
EUVD-2026-90976

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
wind_river vxworks 26.09
wind_river vxworks_7 to 26.09 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an improper privilege management vulnerability in Wind River VxWorks 7 up to version 26.09. When the system is configured to enforce per-user command privileges, certain shell operations may skip the privilege check. This allows an authenticated user with limited privileges to execute unauthorized commands, potentially leading to privilege escalation.

Impact Analysis

An attacker with limited access could exploit this to run privileged commands, compromising the confidentiality, integrity, and availability of the affected device. This could allow unauthorized data access, system modifications, or service disruptions.

Compliance Impact

This vulnerability could lead to unauthorized access or privilege escalation, potentially violating data confidentiality and integrity requirements in standards like GDPR and HIPAA. Unauthorized command execution may allow attackers to access, modify, or delete sensitive data, compromising compliance with these regulations.

Mitigation Strategies

Upgrade Wind River VxWorks to version 26.09 or later to address the improper privilege management vulnerability. Ensure the command shell is configured to enforce per-user command privileges correctly.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104018. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart