Vulnerability-Lookup

CVE-2026-26158 (GCVE-0-2026-26158)

Vulnerability from cvelistv5 – Published: 2026-02-11 20:27 – Updated: 2026-07-15 01:15

Title

Busybox: busybox: arbitrary file modification and privilege escalation via unvalidated tar archive entries

Summary

A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.

Severity

7 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-02-12 04:55 UTC

CWE

CWE-73 - External Control of File Name or Path

Assigner

redhat redhat root

References

6 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:13831	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-26158	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2439040	issue-trackingx_refsource_REDHAT
https://git.busybox.net/busybox/commit/archival?i…
https://cert-portal.siemens.com/productcert/html/…
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex

Impacted products

3 products

Vendor	Product	Version	CPE status
Red Hat	Red Hat Hardened Images	Unaffected: 1.37.0-7.2.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Siemens	RUGGEDCOM RST2428P	Affected: 0 , < V4.0 (custom)	guessed

Date Public

2026-02-11 00:00

Credits

Red Hat would like to thank Calil Khalil (Hakal) for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-26158",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-12T04:55:24.841610Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-26T14:44:23.355Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM RST2428P",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-02T13:01:14.168Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"
          }
        ],
        "x_adpType": "supplier"
      },
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "busybox-main",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1.37.0-7.2.hum1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unknown",
            "packageName": "busybox",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-02-11T00:00:00.000Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-73",
                "description": "External Control of File Name or Path",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-15T01:15:14.401Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-26158"
          },
          {
            "name": "RHBZ#2439040",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2439040"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26158.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:13831"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:13831: Red Hat Hardened Images"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-02-11T18:09:00.001Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-02-11T00:00:00.000Z",
            "value": "Made public."
          }
        ],
        "title": "busybox: BusyBox: Arbitrary file modification and privilege escalation via unvalidated tar archive entries",
        "workarounds": [
          {
            "lang": "en",
            "value": "As a prevention measure, avoid extracting tar archives from untrusted sources using BusyBox, especially when operating with elevated privileges. If processing untrusted archives is unavoidable, ensure that the extraction process is performed within a strictly sandboxed environment with minimal permissions. This operational control reduces the risk of arbitrary file modification and privilege escalation."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "affected",
          "packageName": "busybox-main",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1.37.0-7.2.hum1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "unknown",
          "packageName": "busybox",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Calil Khalil (Hakal) for reporting this issue."
        }
      ],
      "datePublic": "2026-02-11T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Important"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-73",
              "description": "External Control of File Name or Path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-30T04:01:57.299Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:13831",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:13831"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-26158"
        },
        {
          "name": "RHBZ#2439040",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2439040"
        },
        {
          "url": "https://git.busybox.net/busybox/commit/archival?id=3fb6b31c716669e12f75a2accd31bb7685b1a1cb"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-02-11T18:09:00.001Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-02-11T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Busybox: busybox: arbitrary file modification and privilege escalation via unvalidated tar archive entries",
      "workarounds": [
        {
          "lang": "en",
          "value": "As a prevention measure, avoid extracting tar archives from untrusted sources using BusyBox, especially when operating with elevated privileges. If processing untrusted archives is unavoidable, ensure that the extraction process is performed within a strictly sandboxed environment with minimal permissions. This operational control reduces the risk of arbitrary file modification and privilege escalation."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-73: External Control of File Name or Path"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-26158",
    "datePublished": "2026-02-11T20:27:06.979Z",
    "dateReserved": "2026-02-11T17:05:41.991Z",
    "dateUpdated": "2026-07-15T01:15:14.401Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-26158",
      "date": "2026-09-15",
      "epss": "0.00166",
      "percentile": "0.06222"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-26158\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2026-02-11T21:16:21.607\",\"lastModified\":\"2026-07-15T02:19:00.507\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.\"},{\"lang\":\"es\",\"value\":\"Se encontr\u00f3 una falla en BusyBox. Esta vulnerabilidad permite a un atacante modificar archivos fuera del directorio de extracci\u00f3n previsto al crear un archivo tar malicioso que contiene entradas de hardlink o symlink no validadas. Si el archivo tar se extrae con privilegios elevados, esta falla puede conducir a una escalada de privilegios, permitiendo a un atacante obtener acceso no autorizado a archivos cr\u00edticos del sistema.\"}],\"affected\":[{\"source\":\"secalert@redhat.com\",\"affectedData\":[{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Hardened Images\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"busybox-main\",\"cpes\":[\"cpe:/a:redhat:hummingbird:1\"],\"versions\":[{\"version\":\"1.37.0-7.2.hum1\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 6\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"busybox\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:6\"]}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"affectedData\":[{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Hardened Images\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"busybox-main\",\"cpes\":[\"cpe:/a:redhat:hummingbird:1\"],\"versions\":[{\"version\":\"1.37.0-7.2.hum1\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 6\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"busybox\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:6\"]}]},{\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\",\"affectedData\":[{\"vendor\":\"Siemens\",\"product\":\"RUGGEDCOM RST2428P\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"V4.0\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":7.0,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":5.9},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":7.0,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-02-12T04:55:24.841610Z\",\"id\":\"CVE-2026-26158\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-73\"}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-73\"}]}],\"references\":[{\"url\":\"https://access.redhat.com/errata/RHSA-2026:13831\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/security/cve/CVE-2026-26158\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2439040\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://git.busybox.net/busybox/commit/archival?id=3fb6b31c716669e12f75a2accd31bb7685b1a1cb\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:13831\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/security/cve/CVE-2026-26158\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2439040\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-253495.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"},{\"url\":\"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26158.json\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-06-30T04:01:53+00:00",
      "cve": "CVE-2026-26158",
      "id": "CVE-2026-26158",
      "initial_release_date": "2026-02-11T00:00:00+00:00",
      "product_status:fixed": "3",
      "product_status:known_affected": "3",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "busybox: BusyBox: Arbitrary file modification and privilege escalation via unvalidated tar archive entries",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26158.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-07-15T05:25:43Z",
      "cve": "CVE-2026-26158",
      "id": "CVE-2026-26158",
      "initial_release_date": "2026-02-14T00:23:53Z",
      "product_status:known_affected": "10",
      "product_status:recommended": "113",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-26158",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-26158.json",
      "version": "21"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"affected\": [{\"vendor\": \"Siemens\", \"product\": \"RUGGEDCOM RST2428P\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"V4.0\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"x_adpType\": \"supplier\", \"references\": [{\"url\": \"https://cert-portal.siemens.com/productcert/html/ssa-253495.html\"}], \"providerMetadata\": {\"orgId\": \"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\", \"shortName\": \"siemens-SADP\", \"dateUpdated\": \"2026-06-02T13:01:14.168Z\"}}, {\"title\": \"busybox: BusyBox: Arbitrary file modification and privilege escalation via unvalidated tar archive entries\", \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Important\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"cpes\": [\"cpe:/a:redhat:hummingbird:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Hardened Images\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1.37.0-7.2.hum1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"busybox-main\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 6\", \"packageName\": \"busybox\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-02-11T18:09:00.001Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2026-02-11T00:00:00.000Z\", \"value\": \"Made public.\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"RHSA-2026:13831: Red Hat Hardened Images\"}], \"x_adpType\": \"supplier\", \"datePublic\": \"2026-02-11T00:00:00.000Z\", \"references\": [{\"url\": \"https://access.redhat.com/security/cve/CVE-2026-26158\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2439040\", \"name\": \"RHBZ#2439040\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26158.json\", \"tags\": [\"x_sadp-csaf-vex\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:13831\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"As a prevention measure, avoid extracting tar archives from untrusted sources using BusyBox, especially when operating with elevated privileges. If processing untrusted archives is unavoidable, ensure that the extraction process is performed within a strictly sandboxed environment with minimal permissions. This operational control reduces the risk of arbitrary file modification and privilege escalation.\"}], \"x_generator\": {\"engine\": \"sadp-cli 1.0.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-73\", \"description\": \"External Control of File Name or Path\"}]}], \"providerMetadata\": {\"orgId\": \"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\", \"shortName\": \"redhat-SADP\", \"dateUpdated\": \"2026-07-15T01:15:14.401Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-26158\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-02-12T04:55:24.841610Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-02-11T20:50:11.404Z\"}}], \"cna\": {\"title\": \"Busybox: busybox: arbitrary file modification and privilege escalation via unvalidated tar archive entries\", \"credits\": [{\"lang\": \"en\", \"value\": \"Red Hat would like to thank Calil Khalil (Hakal) for reporting this issue.\"}], \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Important\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"cpes\": [\"cpe:/a:redhat:hummingbird:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Hardened Images\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1.37.0-7.2.hum1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"busybox-main\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 6\", \"packageName\": \"busybox\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-02-11T18:09:00.001Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2026-02-11T00:00:00.000Z\", \"value\": \"Made public.\"}], \"datePublic\": \"2026-02-11T00:00:00.000Z\", \"references\": [{\"url\": \"https://access.redhat.com/errata/RHSA-2026:13831\", \"name\": \"RHSA-2026:13831\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/security/cve/CVE-2026-26158\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2439040\", \"name\": \"RHBZ#2439040\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://git.busybox.net/busybox/commit/archival?id=3fb6b31c716669e12f75a2accd31bb7685b1a1cb\"}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"As a prevention measure, avoid extracting tar archives from untrusted sources using BusyBox, especially when operating with elevated privileges. If processing untrusted archives is unavoidable, ensure that the extraction process is performed within a strictly sandboxed environment with minimal permissions. This operational control reduces the risk of arbitrary file modification and privilege escalation.\"}], \"x_generator\": {\"engine\": \"cvelib 1.8.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-73\", \"description\": \"External Control of File Name or Path\"}]}], \"providerMetadata\": {\"orgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"shortName\": \"redhat\", \"dateUpdated\": \"2026-06-30T04:01:57.299Z\"}, \"x_redhatCweChain\": \"CWE-73: External Control of File Name or Path\"}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-26158\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-15T01:15:14.401Z\", \"dateReserved\": \"2026-02-11T17:05:41.991Z\", \"assignerOrgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"datePublished\": \"2026-02-11T20:27:06.979Z\", \"assignerShortName\": \"redhat\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

SUSE-SU-2026:0759-1

Vulnerability from csaf_suse - Published: 2026-03-03 12:16 - Updated: 2026-03-03 12:16

Summary

Security update for busybox

Severity

Important

Scope

2 vulnerabilities in this advisory, including CVE-2026-26158.

CVE-2026-26158

7 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Recommended: 8 products

Open the full advisory

SUSE-SU-2026:0872-1

Vulnerability from csaf_suse - Published: 2026-03-11 17:06 - Updated: 2026-03-11 17:06

Summary

Security update for busybox

Severity

Important

Scope

8 vulnerabilities in this advisory, including CVE-2026-26158.

CVE-2026-26158

7 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Recommended: 20 products

Open the full advisory

SUSE-SU-2026:0892-1

Vulnerability from csaf_suse - Published: 2026-03-13 09:05 - Updated: 2026-03-13 09:05

Summary

Security update for busybox

Severity

Important

Scope

8 vulnerabilities in this advisory, including CVE-2026-26158.

CVE-2026-26158

7 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Recommended: 5 products

Open the full advisory

SUSE-SU-2026:20905-1

Vulnerability from csaf_suse - Published: 2026-03-18 15:27 - Updated: 2026-03-18 15:27

Summary

Security update for busybox

Severity

Important

Scope

2 vulnerabilities in this advisory, including CVE-2026-26158.

CVE-2026-26158

7 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Recommended: 20 products

Open the full advisory

ubuntu-cve-2026-26158

Vulnerability from osv_ubuntu

Published

2026-02-11 21:16

Modified

2026-05-20 15:26

Summary

Details

Severity

7.0 (High)


                    
                      CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-26158	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-26158	REPORT
	https://access.redhat.com/security/cve/CVE-2026-26158	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "busybox",
            "binary_version": "1:1.21.0-1ubuntu1.4+esm1"
          },
          {
            "binary_name": "busybox-initramfs",
            "binary_version": "1:1.21.0-1ubuntu1.4+esm1"
          },
          {
            "binary_name": "busybox-static",
            "binary_version": "1:1.21.0-1ubuntu1.4+esm1"
          },
          {
            "binary_name": "busybox-syslogd",
            "binary_version": "1:1.21.0-1ubuntu1.4+esm1"
          },
          {
            "binary_name": "udhcpc",
            "binary_version": "1:1.21.0-1ubuntu1.4+esm1"
          },
          {
            "binary_name": "udhcpd",
            "binary_version": "1:1.21.0-1ubuntu1.4+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:14.04:LTS",
        "name": "busybox",
        "purl": "pkg:deb/ubuntu/busybox@1:1.21.0-1ubuntu1.4+esm1?arch=source\u0026distro=esm-infra-legacy/trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:1.20.0-8.1ubuntu1",
        "1:1.20.0-9ubuntu1",
        "1:1.20.0-9ubuntu2",
        "1:1.21.0-1ubuntu1",
        "1:1.21.0-1ubuntu1.4",
        "1:1.21.0-1ubuntu1.4+esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "busybox",
            "binary_version": "1:1.22.0-15ubuntu1.4+esm2"
          },
          {
            "binary_name": "busybox-initramfs",
            "binary_version": "1:1.22.0-15ubuntu1.4+esm2"
          },
          {
            "binary_name": "busybox-static",
            "binary_version": "1:1.22.0-15ubuntu1.4+esm2"
          },
          {
            "binary_name": "busybox-syslogd",
            "binary_version": "1:1.22.0-15ubuntu1.4+esm2"
          },
          {
            "binary_name": "udhcpc",
            "binary_version": "1:1.22.0-15ubuntu1.4+esm2"
          },
          {
            "binary_name": "udhcpd",
            "binary_version": "1:1.22.0-15ubuntu1.4+esm2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "busybox",
        "purl": "pkg:deb/ubuntu/busybox@1:1.22.0-15ubuntu1.4+esm2?arch=source\u0026distro=esm-infra/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:1.22.0-15ubuntu1",
        "1:1.22.0-15ubuntu1.4",
        "1:1.22.0-15ubuntu1.4+esm1",
        "1:1.22.0-15ubuntu1.4+esm2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "busybox",
            "binary_version": "1:1.27.2-2ubuntu3.4+esm1"
          },
          {
            "binary_name": "busybox-initramfs",
            "binary_version": "1:1.27.2-2ubuntu3.4+esm1"
          },
          {
            "binary_name": "busybox-static",
            "binary_version": "1:1.27.2-2ubuntu3.4+esm1"
          },
          {
            "binary_name": "busybox-syslogd",
            "binary_version": "1:1.27.2-2ubuntu3.4+esm1"
          },
          {
            "binary_name": "udhcpc",
            "binary_version": "1:1.27.2-2ubuntu3.4+esm1"
          },
          {
            "binary_name": "udhcpd",
            "binary_version": "1:1.27.2-2ubuntu3.4+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "busybox",
        "purl": "pkg:deb/ubuntu/busybox@1:1.27.2-2ubuntu3.4+esm1?arch=source\u0026distro=esm-infra/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:1.22.0-19ubuntu2",
        "1:1.27.2-1ubuntu3",
        "1:1.27.2-1ubuntu4",
        "1:1.27.2-2ubuntu2",
        "1:1.27.2-2ubuntu3",
        "1:1.27.2-2ubuntu3.1",
        "1:1.27.2-2ubuntu3.2",
        "1:1.27.2-2ubuntu3.3",
        "1:1.27.2-2ubuntu3.4",
        "1:1.27.2-2ubuntu3.4+esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "busybox",
            "binary_version": "1:1.30.1-4ubuntu6.5"
          },
          {
            "binary_name": "busybox-initramfs",
            "binary_version": "1:1.30.1-4ubuntu6.5"
          },
          {
            "binary_name": "busybox-static",
            "binary_version": "1:1.30.1-4ubuntu6.5"
          },
          {
            "binary_name": "busybox-syslogd",
            "binary_version": "1:1.30.1-4ubuntu6.5"
          },
          {
            "binary_name": "udhcpc",
            "binary_version": "1:1.30.1-4ubuntu6.5"
          },
          {
            "binary_name": "udhcpd",
            "binary_version": "1:1.30.1-4ubuntu6.5"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "busybox",
        "purl": "pkg:deb/ubuntu/busybox@1:1.30.1-4ubuntu6.5?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:1.30.1-4ubuntu4",
        "1:1.30.1-4ubuntu5",
        "1:1.30.1-4ubuntu6",
        "1:1.30.1-4ubuntu6.1",
        "1:1.30.1-4ubuntu6.2",
        "1:1.30.1-4ubuntu6.3",
        "1:1.30.1-4ubuntu6.4",
        "1:1.30.1-4ubuntu6.5"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "busybox",
            "binary_version": "1:1.30.1-7ubuntu3.1"
          },
          {
            "binary_name": "busybox-initramfs",
            "binary_version": "1:1.30.1-7ubuntu3.1"
          },
          {
            "binary_name": "busybox-static",
            "binary_version": "1:1.30.1-7ubuntu3.1"
          },
          {
            "binary_name": "busybox-syslogd",
            "binary_version": "1:1.30.1-7ubuntu3.1"
          },
          {
            "binary_name": "udhcpc",
            "binary_version": "1:1.30.1-7ubuntu3.1"
          },
          {
            "binary_name": "udhcpd",
            "binary_version": "1:1.30.1-7ubuntu3.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "busybox",
        "purl": "pkg:deb/ubuntu/busybox@1:1.30.1-7ubuntu3.1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:1.30.1-6ubuntu3",
        "1:1.30.1-7ubuntu1",
        "1:1.30.1-7ubuntu2",
        "1:1.30.1-7ubuntu3",
        "1:1.30.1-7ubuntu3.1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "busybox",
            "binary_version": "1:1.36.1-6ubuntu3.1"
          },
          {
            "binary_name": "busybox-initramfs",
            "binary_version": "1:1.36.1-6ubuntu3.1"
          },
          {
            "binary_name": "busybox-static",
            "binary_version": "1:1.36.1-6ubuntu3.1"
          },
          {
            "binary_name": "busybox-syslogd",
            "binary_version": "1:1.36.1-6ubuntu3.1"
          },
          {
            "binary_name": "udhcpc",
            "binary_version": "1:1.36.1-6ubuntu3.1"
          },
          {
            "binary_name": "udhcpd",
            "binary_version": "1:1.36.1-6ubuntu3.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "busybox",
        "purl": "pkg:deb/ubuntu/busybox@1:1.36.1-6ubuntu3.1?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:1.36.1-3ubuntu1",
        "1:1.36.1-6ubuntu1",
        "1:1.36.1-6ubuntu3",
        "1:1.36.1-6ubuntu3.1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "busybox",
            "binary_version": "1:1.37.0-4ubuntu1"
          },
          {
            "binary_name": "busybox-initramfs",
            "binary_version": "1:1.37.0-4ubuntu1"
          },
          {
            "binary_name": "busybox-static",
            "binary_version": "1:1.37.0-4ubuntu1"
          },
          {
            "binary_name": "busybox-syslogd",
            "binary_version": "1:1.37.0-4ubuntu1"
          },
          {
            "binary_name": "udhcpc",
            "binary_version": "1:1.37.0-4ubuntu1"
          },
          {
            "binary_name": "udhcpd",
            "binary_version": "1:1.37.0-4ubuntu1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "busybox",
        "purl": "pkg:deb/ubuntu/busybox@1:1.37.0-4ubuntu1?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:1.37.0-4ubuntu1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "busybox",
            "binary_version": "1:1.37.0-7ubuntu1"
          },
          {
            "binary_name": "busybox-initramfs",
            "binary_version": "1:1.37.0-7ubuntu1"
          },
          {
            "binary_name": "busybox-static",
            "binary_version": "1:1.37.0-7ubuntu1"
          },
          {
            "binary_name": "busybox-syslogd",
            "binary_version": "1:1.37.0-7ubuntu1"
          },
          {
            "binary_name": "udhcpc",
            "binary_version": "1:1.37.0-7ubuntu1"
          },
          {
            "binary_name": "udhcpd",
            "binary_version": "1:1.37.0-7ubuntu1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "busybox",
        "purl": "pkg:deb/ubuntu/busybox@1:1.37.0-7ubuntu1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:1.37.0-4ubuntu1",
        "1:1.37.0-7ubuntu1"
      ]
    }
  ],
  "aliases": [],
  "details": "A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.",
  "id": "UBUNTU-CVE-2026-26158",
  "modified": "2026-05-20T15:26:06Z",
  "published": "2026-02-11T21:16:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-26158"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-26158"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-26158"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-26158"
  ]
}

WID-SEC-W-2026-0395

Vulnerability from csaf_certbund - Published: 2026-02-11 23:00 - Updated: 2026-05-05 22:00

Summary

BusyBox: Mehrere Schwachstellen

Severity

Mittel

Scope

2 vulnerabilities in this advisory, including CVE-2026-26158.

CVE-2026-26158

Known affected: 4 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-26158 (GCVE-0-2026-26158)

SUSE-SU-2026:0759-1

SUSE-SU-2026:0872-1

SUSE-SU-2026:0892-1

SUSE-SU-2026:20905-1

ubuntu-cve-2026-26158

Vulnerability from osv_ubuntu

WID-SEC-W-2026-0395

Tags

Sightings

Nomenclature