CVE-2026-89040

CVSS 9.8 (critical) · published 2026-09-15

Tencent Mass Service Engine in Cluster (MSEC) allows a remote, unauthenticated attacker to send a crafted POST request including ../ and gain root access on the target device. An attacker who uploads a webshell can execute arbitrary code as root.

Weakness: CWE-22

Source: NVD CVE-2026-89040

References

• https://github.com/Tencent/MSEC
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-258-02.json
• https://www.cve.org/CVERecord?id=CVE-2026-89040

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.