THREAT OPS › Threat News › [NVD] CVE-2026-23920 (HIGH 8.8) — Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected newline lets authenticated users bypass the check and inject shell commands.
[NVD] CVE-2026-23920 (HIGH 8.8) — Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected newline lets authenticated users bypass the check and inject shell commands.
CVE-2026-23920 CVSS: 8.8 HIGH Published: 2026-03-24T19:16:49.557
Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected newline lets authenticated users bypass the check and inject shell commands.
Indicators of compromise
- CVE-2026-23920cve
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-23920