CVE-2026-60036
HighCVSS 7.2Summary
A high-privileged remote attacker can perform code injection in the backend's patch activate function, leading to code execution.
Risk Assessment
This can result in a total loss of confidentiality, integrity, and availability.
Recommendation
Apply the vendor patches, restrict privileges for the patch activate function, and implement input validation.
Other vulnerabilities in Backend web application
See all- CVE-2026-60046High
An unauthenticated remote attacker can perform password resets for any user with a known username and email without rate limiting.
- CVE-2026-60041High
An unauthenticated remote attacker can perform a CSRF attack on a logged-in backend user, allowing execution of multiple critical system actions such as shutting down the server or restoring an uploaded backup.
- CVE-2026-60035High
A high-privileged remote attacker can perform code injection in the backend's network auth function, leading to code execution.
- CVE-2026-60043Critical
An unauthenticated remote attacker can perform an XSS attack on a logged-in backend user, allowing execution of multiple critical system actions such as shutting down the server or restoring an uploaded backup.
Original NVD description (English source)
A high privileged remote attacker can perform a code injection in the backends patch activate function leading to code execution. This can result in a total loss of confidentiality, integrity and availability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS