{"id":"CVE-2026-13014","title":"A vulnerability in Thales CERT \"Suspicious\" application =< 1.3.4 allows a remote and unauthenticated attacker to execute arbitrary code and arbitrarily overwrite writable application files—including Python modules, configuration files, c…","summary":"A vulnerability in Thales CERT \"Suspicious\" application =< 1.3.4 allows a remote and unauthenticated attacker to execute arbitrary code and arbitrarily overwrite writable application files—including Python modules, configuration files, c…","severity":"critical","cwe":["CWE-22","CWE-73","CWE-94"],"published":"2026-07-13","updated":"2026-07-13","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-13014","references":[{"url":"https://github.com/thalesgroup-cert/suspicious/security/advisories/GHSA-x85x-9mrm-wwvp","label":"psirt@thalesgroup.com"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-07-13T12:26:58.209Z","epss":0.00704,"epssPercentile":0.5311,"vendor":"Thales CERT","product":"Suspicious","affected":["Suspicious >= v1.2.0 <= v1.3.4"],"cvss":9.2,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-07-13T14:06:22.643365Z"},"cvssSource":"cna","slug":"CVE-2026-13014","body":"## Overview\n\nA vulnerability in Thales CERT \"Suspicious\" application =< 1.3.4 allows a remote and unauthenticated attacker to execute arbitrary code and arbitrarily overwrite writable application files—including Python modules, configuration files, cron inputs, and runtime artifacts—leading to a persistent denial of service, the potential compromise of application secrets or integrations, and root-level execution inside the Django application container.\nThis vulnerability has been names \"Matryoshka Mail\".\nThales PSIRT \nacknowledges and thanks\n\nLucien Doustaly (aka wlayzz) for discovering and reporting this issue.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":51,"depthScoreParts":{"impact":50.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":214619,"id":"CVE-2026-13014","ts":1790881128721,"field":"cvss","old":null,"new":"9.2"},{"seq":214618,"id":"CVE-2026-13014","ts":1790881128721,"field":"severity","old":"none","new":"critical"}]}