---
id: CVE-2026-104018
title: "An improper privilege management vulnerability (CWE-269) exists in the command shell of Wind River VxWorks 7\_when configured to enforce per-user command privileges"
summary: "An improper privilege management vulnerability (CWE-269) exists in the command shell of Wind River VxWorks 7\_when configured to enforce per-user command privileges. Under certain shell operations, a command may be evaluated without the p…"
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-269
vendor: Wind River Systems Inc
product: VxWorks 7
affected:
  - vxworks_7 VxWorks 7
published: '2026-10-01'
updated: '2026-10-02'
sourceUpdated: '2026-10-02T18:44:11.270'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-104018'
references:
  - url: >-
      https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2026-104018
    label: 0bf9931a-6ebf-4f48-bd14-39ee5e1d61f8
tags:
  - nvd
  - cve.org
epss: 0.00636
epssPercentile: 0.5029
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-01T18:09:28.226543Z'
ingestedAt: '2026-10-01T18:55:42.368Z'
---

## Overview

An improper privilege management vulnerability (CWE-269) exists in the command shell of Wind River VxWorks 7 when configured to enforce per-user command privileges. Under certain shell operations, a command may be evaluated without the privilege check that is normally applied, allowing an authenticated user with limited privileges to execute commands they are not authorized to run. Successful exploitation can result in privilege escalation, with impact to the confidentiality, integrity, and availability of the affected device. The issue affects all versions of VxWorks 7 prior to 26.09.  It has been fixed in 26.09.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.