Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2026-89040: Tencent MSEC lets attacker gain root via crafted request
CVE-2026-89040 · published 26 days ago
Summary
The Tencent Mass Service Engine in Cluster can be tricked by an unauthenticated attacker sending a specially crafted web request that includes directory‑traversal sequences (../). This can give the attacker full administrative control of the device and let them upload a malicious script to run any code they choose. Apply the vendor’s security update or patch immediately to block the unsafe request handling.
What to do
- Update tencent mass service engine in cluster (msec) to version * or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| tencent | mass service engine in cluster (msec) | < * |
Original advisory text
Tencent Mass Service Engine in Cluster (MSEC) path traversal
Tencent Mass Service Engine in Cluster (MSEC) allows a remote, unauthenticated attacker to send a crafted POST request including ../ and gain root access on the target device. An attacker who uploads a webshell can execute arbitrary code as root.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-22Path Traversal
Timeline
Published15 Sep 2026
Updated7 Oct 2026
First seen15 Sep 2026
Track software like this
Free during beta