CVE-2026-77099CWE-78command-injection

CVE-2026-77099

published October 13, 2026

CVSS

9.3

EPSS

Percentile

31.7

In the wild

Unconfirmed

What it is

CVFS contained an input validation issue affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS.

The record

Technical detail

CVSS: 9.3 · NONE
CVSS v4.0: 9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS: 0.00388 · 31.7th percentile
Weakness: CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published: 2026-10-13T19:17Z

References (1)

EPSS history

Timeline