What’s Vulnerable › Vulnerabilities

CVE-2026-78237: Insufficient input validation in Admin By Request (ABR)

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-26 · updated 2026-09-03
• Weakness: CWE-20

Description

Insufficient input validation in ABR allows a low-privileged user to inject malicious entries into the sudoers file, resulting in persistent root access that remained effective after the ABR session ended.

Affected products

• Admin By Request (ABR): through 5.2.2

References

• https://docs.adminbyrequest.com/security-advisories/abr-mac-26-02.htm
• https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-110/

Get alerted when CVE-2026-78237 or the next vulnerability affects your stack