CVE-2026-27728 - Vulnerability Analysis
CriticalCVSS: 9.9Last Updated: February 27, 2026
OneUptime - Command Injection
Overview
OneUptime < 10.0.7 contains a command injection caused by improper sanitization in NetworkPathMonitor.performTraceroute(), letting authenticated project users execute arbitrary OS commands on the Probe server, exploit requires user authentication.
Severity & Score
Impact
Authenticated users can execute arbitrary OS commands on the Probe server, potentially leading to full system compromise.
Mitigation
Upgrade to version 10.0.7 or later.
References
Social Media Activity(2 posts)
š“ CVE-2026-27728 - Critical (9.9) OneUptime is a solution for monitoring and managing online services. Prior to version 10.0.7, an OS command injection vulnerability in `NetworkPathMonitor.performTraceroute()` allows any authenticated project user to execute arbitrary operating sy... š https://www.thehackerwire.com/vulnerability/CVE-2026-27728/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
View original postš“ CVE-2026-27728 - Critical (9.9) OneUptime is a solution for monitoring and managing online services. Prior to version 10.0.7, an OS command injection vulnerability in `NetworkPathMonitor.performTraceroute()` allows any authenticated project user to execute arbitrary operating sy... š https://www.thehackerwire.com/vulnerability/CVE-2026-27728/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
View original postRelated Resources
Details
- CVE ID
- CVE-2026-27728
- Severity
- Critical
- CVSS Score
- 9.9
- Type
- command_injection
- Status
- unconfirmed
- EPSS
- 24.5%
- Social Posts
- 2
CWE
- CWE-78
CVSS Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H