Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-85979: Puppet Enterprise lets admin run any command

CVE-2026-85979 · published 29 days ago

Summary

In certain versions of Puppet Enterprise, an admin user can enter specially crafted data that causes the system to run any shell command with full system rights. This could let an attacker take complete control of the server. Upgrade to Puppet Enterprise 2023.8.11 or 2025.11.3 (or later) to fix the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	perforce software	puppet enterprise	<= 2023.8.10
Ubuntu:24.04:LTS	canonical	puppetserver	All versions

Original advisory text

Command Injection in Puppet Enterprise

Affected versions of Puppet Enterprise contain a command injection vulnerability. An authenticated user with Puppet administrative privileges can inject arbitrary shell commands by providing a specially crafted value for this parameter, which is passed to a shell execution context without sufficient sanitization. Because the resulting commands are executed with root privileges, successful exploitation can lead to full compromise of the affected system.

It affects Puppet Enterprise 2023.8.0 through 2023.8.10 and Puppet Enterprise 2025.0.0 through 2025.11.2.

This has been resolved in Puppet Enterprise 2023.8.11 and Puppet Enterprise 2025.11.3.

References

https://portal.perforce.com/s/cve/a91Qi000003CybNIAS/command-injection-in-puppet...
https://ubuntu.com/security/CVE-2026-85979 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-85979 Third Party Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

8.6 High

Exploitation

1% chance of attack within 30 days

Type

CWE-78OS Command Injection

CWE-20Improper Input Validation

CWE-269Improper Privilege Management

Timeline

Published11 Sep 2026

Updated9 Oct 2026

First seen11 Sep 2026

Sources

CVE-2026-85979 · NVD

CVE-2026-85979 · MITRE

UBUNTU-CVE-2026-85979 · OSV

Track software like this

Free during beta