CVE-2026-77966CWE-862broken-access-control

CVE-2026-77966

High · published August 31, 2026

CVSS v3.1

8.8

EPSS

Percentile

37.4

In the wild

Unconfirmed

What it is

The affected Ebyte

product does not provide separation between limited and administrative

management functions. A low privileged authenticated attacker could

access security sensitive configuration functions and modify settings

that affect the confidentiality, integrity, or availability of the

device.

The record

Technical detail

CVSS v3.1: 8.8 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: 8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS: 0.00442 · 37.4th percentile
Weakness: CWE-862 · Missing Authorization
Published: 2026-08-31T20:19Z

References (2)

EPSS history

Timeline