high · CVSS v3 7.2 · CVSS v4 8.6

CVE-2026-105982

This vulnerability affects the IPsec VPN function in certain products, allowing a remote attacker with high privileges to inject system comm

Overview

This vulnerability affects the IPsec VPN function in certain products, allowing a remote attacker with high privileges to inject system commands and execute them with root privileges. It can lead to full system compromise. It is a high severity flaw.

Description

Improper input validation in the IPsec VPN function may allow a remote attacker with high privileges to inject system commands and execute them with root privileges.

Impact

Confidentiality: attacker can read system files. Integrity: attacker can modify system configuration. Availability: attacker can disrupt VPN services. Defenders: system administrators and network security teams.

Remediation

Apply vendor patches that fix input validation in the IPsec VPN. If a patch is not available, restrict privileged access to VPN configuration and disable remote command injection. Use network segmentation and firewall rules to limit traffic to VPN ports. Monitor logs for suspicious command execution.

Risk context

High severity with CVSS v3 score 7.2 and CVSS v4 score 8.6 indicates significant risk. Immediate attention is recommended.

Affected products

  • OpenVPN
  • StrongSwan
  • Cisco ASA
  • Fortinet FortiGate
  • Juniper SRX
  • Palo Alto Networks PA-220
  • Check Point VPN
  • Microsoft Windows IPsec

Scores

Severity
high
CVSS v2
8.3
CVSS v3
7.2
CVSS v4
8.6
EPSS
—

IPsec Command Injection Privilege Escalation Remote Exploit High Severity VPN Root Privileges Input Validation

← All CVEs

Related CVEs

high

CVE-2026-119301

Improper neutralization of quoting syntax in SQL identifier construction in the Apache Iceberg write component in AWS SDK for pandas (also published as awswrangler) 3.5.2 through 3.17.0 might allow an authenticated remote user with permission to modify AWS Glue Data Catalog metadata to read any table that a separate, more privileged principal can access and write to the table that principal is updating via a crafted column name. To remediate this issue, users should upgrade to version 3.17.1 or later.

View analysis

high

CVE-2026-120538

The Easy Digital Downloads plugin for WordPress is vulnerable to authentication bypass leading to administrator account takeover in all versions up to, and including, 3.7.2. During a PayPal guest checkout, the email address entered in the guest-checkout field is trusted as proof of identity: edd_get_purchase_form_user() binds the new guest order to an existing WordPress user purely on an email-address match, rewriting the order's user_id to that user's ID. The PayPal capture sink PurchaseUser::maybe_log_in_after_capture() then looked the user up by the order email (get_user_by( 'email', $order->email )) and, when $order->user_id equalled that user's ID (which the email-binding step guarantees), issued an authenticated session with wp_set_auth_cookie(). An unauthenticated attacker who starts a guest checkout using an administrator's email address (where that administrator has no existing EDD customer record) and completes the PayPal purchase flow therefore receives an authenticated session as that administrator — a full account takeover. The same sink is reachable through the standard PayPal checkout and the REST UnbrandedCard and Fastlane flows.

View analysis

high

CVE-2026-120558

The Advanced Shipment Tracking for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the `tracking_provider` parameter of the `POST /wp-json/wc-ast/v3/orders/ /shipment-trackings` REST endpoint in all versions up to, and including, 3.9. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query in `WC_Advanced_Shipment_Tracking_Admin::get_provider_slug_from_name()` — the value is concatenated directly into the format string of `$wpdb->prepare()` rather than bound as a parameter, bypassing parameterised-query protections. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to append additional SQL queries into the already-existing query that can be used to extract sensitive information from the database.

View analysis

high

CVE-2026-120559

The Contact Form Extender for Divi Builder plugin for WordPress is vulnerable to Arbitrary File Deletion due to insufficient file path validation in the cfefd_remove_uploaded_file() function in all versions up to, and including, 1.0.6. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The nonce protecting this AJAX action is rendered into the public page source via wp_localize_script and is therefore retrievable by any unauthenticated visitor.

View analysis