CVE-2026-89040
Tencent Mass Service Engine in Cluster (MSEC) allows a remote, unauthenticated attacker to send a crafted POST request including ../ and gain root access on the target device. An attacker who uploads a webshell can execute arbitrary code as root.
- Published Sep 15, 2026
- CVSS 9.3 critical
- 1.1% chance of exploitation in the next 30 days (EPSS)