CVE-2026-8326: Remote Spark SparkView Path Traversal in RDP Drive Redirection leading to RCE

Severity: critical (CVSS 10.0 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-29 · updated 2026-07-21
Weakness: CWE-23

Description

Path traversal vulnerability in Remote Spark (https://www.Remotespark.Com/) SparkView allows reading and writing arbitrary files in all directories as root. This leads to RCE. The affected component is the RDP drive redirection. Depending on implementation, the vulnerability can be exploited by an unauthenticated attacker. This issue affects SparkView: before build 1127.

Affected products

Remote Spark (https://www.remotespark.com/) SparkView: before build 1127 — fixed in build 1127

How to fix

Upgrade to a fixed version: Remote Spark (https://www.remotespark.com/) SparkView build 1127. Check the vendor advisory for mitigations.

References

https://www.remotespark.com/view/new.html

Get alerted when CVE-2026-8326 or the next vulnerability affects your stack