THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-39910 (HIGH 8.8) — STACKIT IaaS API contains a missing authorization check vulnerability that allows authenticated, low-privileged attackers to escalate privileges to full organization compromise by attaching arbitrary service accounts to virtual machines they control. Attackers can exploit the unv

[NVD] CVE-2026-39910 (HIGH 8.8) — STACKIT IaaS API contains a missing authorization check vulnerability that allows authenticated, low-privileged attackers to escalate privileges to full organization compromise by attaching arbitrary service accounts to virtual machines they control. Attackers can exploit the unv

lownvdPublished 2026-06-08

CVE-2026-39910 CVSS: 8.8 HIGH Published: 2026-06-08T17:16:42.613

STACKIT IaaS API contains a missing authorization check vulnerability that allows authenticated, low-privileged attackers to escalate privileges to full organization compromise by attaching arbitrary service accounts to virtual machines they control. Attackers can exploit the unvalidated PUT servers service-accounts endpoint to atta

Indicators of compromise

CVE-2026-39910cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-39910