What’s Vulnerable › Vulnerabilities
CVE-2026-90999: Sentry Seer vulnerability allows attacker-controlled input to be executed in a privileged environment
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.7% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-16 · updated 2026-09-18
- Weakness: CWE-20
Description
Sentry Seer is vulnerable to a multi-stage trust-boundary violation that allows unauthenticated attacker-controlled telemetry to become code that is executed by an agent in a privileged automation environment. An external attacker can submit fabricated Sentry events without having access to the victim’s Sentry account, source repository, or infrastructure.
Affected products
- Functional Software, Inc. Sentry Seer: Web site
References
Get alerted when CVE-2026-90999 or the next vulnerability affects your stack