External risk intelligence

Authenticated Code Execution Leading to Root Compromise

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-9645

The vulnerability involves exposed methods allowing code execution on the server. While the attack vector is network-based, the description implies the target is an application function requiring authentication. It is plausibly reachable from the internet in some deployments, but the context does not confirm it is a standard public-facing edge service or gateway.

OS Command Injection

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability allows authenticated users to run custom code on servers, potentially leading to full system control. While it requires prior access, the ability to execute commands as a system administrator presents a significant risk if exploited. Confirming relevance and exposure is the main concern.

Allows authenticated users to run custom code.
Potential for complete system compromise exists.
Confirm relevance and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker could begin by gaining authenticated access to the affected system. From there, they can utilize exposed methods to craft and execute arbitrary JavaScript code. This code then runs on the server with high privileges, potentially leading to a full system compromise.

Authenticated access required to start.
Exposed methods trigger the vulnerability.
Risk of complete system compromise.

Live Threat

Current exploitation, exposure, and threat context

Authenticated users could execute arbitrary JavaScript code on the server, potentially leading to a full system compromise. This is possible when exposed methods allow for script creation and execution, and when those scripts are run with root privileges.

Server system and data access.
Via exposed, authenticated methods.
Complete system compromise is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability, allowing authenticated users to execute arbitrary JavaScript code as root on the server, likely falls under the responsibility of application owners and platform teams. The immediate priority is to identify all instances of the affected technology, assess their reachability and criticality, and locate the accountable system owner to plan remediation based on risk.

Application owners should own this issue.
Verify script execution reachability and impact.
Plan remediation with vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the software affected by CVE-2026-9645?

The software involved is a server-side application that processes scripts. It provides functional methods intended for authenticated users to perform operations, but these features are improperly secured, allowing them to be repurposed to execute unintended commands at the system level.

What is the vulnerability class for CVE-2026-9645?

This vulnerability is categorized as CWE-78, which is OS Command Injection. In this specific case, the application fails to safely handle input or restrict access to methods that interface with the server, enabling an attacker to run arbitrary JavaScript that the operating system then executes with root-level privileges.

How does an attacker trigger this vulnerability?

An attacker must first obtain legitimate authenticated access to the application. Once authenticated, they invoke exposed administrative or functional methods that were designed to handle code execution but lack sufficient checks. Importantly, this does not happen through unauthenticated requests; the process relies on using the application's own authorized pathways to inject malicious scripts.

Is CVE-2026-9645 a risk to my internet-facing systems?

According to Halo Surface Signal, this vulnerability is classified as potentially reachable from the internet. While it requires authentication, any instance of this software that allows login from external networks could be at risk. You should evaluate whether your deployment is exposed to the public internet versus restricted to internal users.

What should I do first to address this security risk?

Start by identifying all instances of the application within your environment and determining which are accessible over a network. Once identified, coordinate with the system owners to audit user access controls and monitor for unauthorized script execution. Your primary goal is to limit exposure while working with the vendor to obtain and apply the necessary security updates.

References

www.tenable.com/security/research/tra-2026-46

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.