THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-86177 (HIGH 8.8) — Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subusers with only schedule.update permission to execute arbitrary console commands. Attackers can create and immediately trigger scheduled tasks that run game-serve

[NVD] CVE-2026-86177 (HIGH 8.8) — Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subusers with only schedule.update permission to execute arbitrary console commands. Attackers can create and immediately trigger scheduled tasks that run game-serve

mednvdPublished 2026-09-05

CVE-2026-86177 CVSS: 8.8 HIGH Published: 2026-09-05T11:16:46.397

Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subusers with only schedule.update permission to execute arbitrary console commands. Attackers can create and immediately trigger scheduled tasks that run game-server console commands, control server power state, or cre

MITRE ATT&CK techniques

Scheduled TaskT1053.005

Indicators of compromise

CVE-2026-86177cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-86177