Security feed

24 October 2026

advisoryHighOfficial CVE List24 Oct 2026

VxWorks 7 improper privilege management

An improper privilege management vulnerability (CWE-269) exists in the command shell of Wind River VxWorks 7 when configured to enforce per-user command privileges. Under certain shell operations, a command may be evaluated without the privilege check that is normally applied, allowing an authenticated user with limited privileges to execute commands they are not authorized to run. Successful exploitation can result in privilege escalation, with impact to the confidentiality, integrity, and availability of the affected device. The issue affects all versions of VxWorks 7 prior to 26.09. It has been fixed in 26.09.

Announced 1 Oct 2026

VxWorks 7 CVE-2026-104018

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-104018

VxWorks 7

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-104018
Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event: #7832 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 22:50:38 GMT
Publisher date: Thu, 01 Oct 2026 17:35:20 GMT

Read the original announcement

advisoryMediumOfficial CVE List24 Oct 2026

VxWorks 7 Memory allocation

In Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in the process management subsystem failing to properly release allocated kernel memory before terminating the calling application. Fixed in Version 26.09

Announced 28 Sept 2026

VxWorks 7 CVE-2026-102006

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-102006

VxWorks 7

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-102006
Source reference: /cveMetadata/cveId

Publisher severity

medium

Source reference: /containers/cna/metrics

Event: #4367 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:50:52 GMT
Publisher date: Mon, 28 Sep 2026 20:46:35 GMT

Read the original announcement

advisoryHighOfficial CVE List24 Oct 2026

VxWorks 7

Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in memory corruption within the memory management subsystem. Fixed in Version 26.09

Announced 28 Sept 2026

VxWorks 7 CVE-2026-102004

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-102004

VxWorks 7

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-102004
Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event: #3772 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:40:35 GMT
Publisher date: Mon, 28 Sep 2026 19:47:18 GMT

Read the original announcement

advisoryMediumOfficial CVE List24 Oct 2026

VxWorks 7 Memory Resource leak

Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in the IPNET subsystem failing to properly release allocated kernel memory and system file descriptors before terminating the calling application. Fixed in Version 26.09.

Announced 28 Sept 2026

VxWorks 7 CVE-2026-97686

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-97686

VxWorks 7

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-97686
Source reference: /cveMetadata/cveId

Publisher severity

medium

Source reference: /containers/cna/metrics

Event: #3349 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:33:51 GMT
Publisher date: Mon, 28 Sep 2026 18:48:23 GMT

Read the original announcement

advisoryMediumOfficial CVE List24 Oct 2026

VxWorks Memory Allocation

Wind River VxWorks 7 24.03 through 26.03, a memory leak occurs under specific, non-default configuration states when processing specific service routines, causing the system to terminate operations before releasing allocated memory pools. Fixed in VxWorks 7 26.09

Announced 28 Sept 2026

VxWorks 7 CVE-2026-102005

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-102005

VxWorks 7

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-102005
Source reference: /cveMetadata/cveId

Publisher severity

medium

Source reference: /containers/cna/metrics

Event: #3343 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:33:47 GMT
Publisher date: Mon, 28 Sep 2026 20:15:52 GMT

Read the original announcement