CVE-2026-49190CWE-78

Missing Per-Instruction Authorization Checks

Critical · published June 4, 2026

CVSS v4.0
9.4
EPSS
1%
Percentile
56.4
In the wild
Unconfirmed
What it is

The system fails to evaluate instructional permissions over multiple internal operation codes (opcodes), permitting unauthorized application installations or command executions.

The record
Technical detail
CVSS v4.0
9.4 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.00808 · 56.4th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-06-04T05:28Z
EPSS history
Timeline
  • 04 JUN 05:28Z
    Missing Per-Instruction Authorization Checks
    cvelistv5