Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-90999: Sentry Seer can run attacker code in automation
CVE-2026-90999 · published 12 days ago
Summary
Sentry Seer may let an outside person send false event data that is treated as code and run by its automation agent with high privileges. This could let a hacker perform actions on your systems without any login credentials. Apply the latest vendor update and restrict who can post events to the system, or temporarily disable unauthenticated event intake until the fix is installed.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| functional software, inc. | sentry seer | Web site |
Original advisory text
Sentry Seer vulnerability allows attacker-controlled input to be executed in a privileged environment
Sentry Seer is vulnerable to a multi-stage trust-boundary violation that allows unauthenticated attacker-controlled telemetry to become code that is executed by an agent in a privileged automation environment. An external attacker can submit fabricated Sentry events without having access to the victim’s Sentry account, source repository, or infrastructure.
Severity
9.8
Critical
Exploitation
EPSS <1%
Type
CWE-20Improper Input Validation
CWE-74Injection
CWE-116Improper Encoding or Escaping of Output
CWE-94Code Injection
CWE-913Improper Control of Dynamically-Managed Code Resources
Timeline
Published16 Sep 2026
Updated27 Sep 2026
First seen16 Sep 2026
Track software like this
Free during beta