EUVD-2026-79672
GHSA-wfq6-vqf6-g78h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed MSEC endpoint
-
DeliverySend crafted POST with ../ traversal
-
ExploitWrite webshell outside upload dir
-
ExecutionRequest webshell to execute code
-
ImpactGain arbitrary command execution as root
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against a network-reachable Tencent MSEC service. The only prerequisite is that the vulnerable MSEC HTTP/upload endpoint accepting POST requests is exposed to the attacker; exploitation requires no authentication (PR:N), no user interaction (UI:N), and no non-default configuration per the CVSS vector. The principal limiting factor is deployment footprint: MSEC is a niche open-source distributed backend framework, so realistic exposure depends on whether the target actually runs MSEC and exposes its request-handling service to the attacker's network. |
| Impact | All exploitability signals point the same direction: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remote, unauthenticated, low-complexity attack with no user interaction, and the description confirms a classic path-traversal-to-RCE chain (send POST with ../, upload webshell, execute as root). Technical impact is total on the affected host - VC:H/VI:H/VA:H, i.e. full confidentiality, integrity and availability compromise with root privileges. That justifies the 9.3 base score. However, the real-world urgency is tempered by product footprint rather than by the flaw's mechanics: there is NO EPSS score, NO CISA KEV listing, and NO public POC referenced in the input, so this is 'no public exploit identified at time of analysis' rather than confirmed exploitation. The result is a technically critical, trivially exploitable pre-auth root RCE whose priority is gated almost entirely by whether MSEC is actually deployed in a given environment - treat as urgent where present, but note it is not (yet) a known-exploited or mass-scanned target. No conflicting signals were found; the CVSS vector and the description are consistent. |
| Exploit ScenarioDerived | A remote attacker with no credentials sends a crafted POST request containing ../ directory-traversal sequences to a network-exposed MSEC service, writing a webshell outside the intended upload directory. They then request the webshell and execute arbitrary commands as root, achieving full control of the device. No public exploit code is referenced, but the technique (path traversal → webshell upload → RCE) is well understood and trivially reproducible. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Unauthenticated remote code execution in Tencent Mass Service Engine in Cluster (MSEC) lets a network-positioned attacker submit a crafted POST request containing ../ sequences to escape the intended upload directory, drop a webshell, and execute arbitrary commands with root privileges on the host. The exploitability signals are uniform: the vendor-assigned CVSS 4.0 base score of 9.3 with vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H describes a remote, low-complexity attack requiring no authentication and no user interaction, and our independent assessment (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reaches the same conclusion. The practical limiting factor is deployment footprint rather than attack difficulty: MSEC is a niche open-source distributed backend framework, so real-world risk depends on whether a target actually runs MSEC and exposes its HTTP/upload request-handling service to the attacker's network; exploitation status is no public exploit identified at time of analysis (no CISA KEV entry and no published PoC in the supplied intelligence).
RemediationAI
No vendor-released patch identified at time of analysis, and no fixed version can be cited from the supplied data, so remediation must begin with containment. First, remove network reachability to the MSEC request/upload endpoint from untrusted clients, using firewall rules, network segmentation, or a reverse proxy allow-list that permits only known administrative source addresses; the trade-off is reduced operational flexibility for legitimate clients that previously reached MSEC directly. Second, if the file-upload or POST-handling capability is not required in the deployment, disable or remove that endpoint entirely, accepting the loss of the associated functionality. Third, run the MSEC service as an unprivileged, dedicated user inside a container or sandbox with read-only or narrowly scoped writable mounts; this does not fix the traversal flaw but removes the root-privilege impact that makes the chain a full host compromise, at the cost of possible application errors if MSEC expects privileged paths. Fourth, deploy a WAF or proxy rule set that rejects traversal sequences (including percent-encoded and double-encoded variants such as %2e%2e%2f and ..%2f) in POST bodies, multipart filenames, and Content-Disposition headers; note this is an evasion-prone layer and must not be treated as a substitute for patching. Fifth, monitor filesystem writes from the MSEC process, especially new files in web-served or executable directories, to detect webshell drops. Track the upstream project at https://github.com/Tencent/MSEC and the records at https://www.cve.org/CVERecord?id=CVE-2026-89040, https://nvd.nist.gov/vuln/detail/CVE-2026-89040, and the CISA CSAF advisory at https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-258-02.json for a vendor fix, and apply it as soon as a version is published.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, i.e. path traversal) in MSEC's HTTP request/upload handling. MSEC (Mass Service Engine in Cluster) is Tencent's open-source distributed service framework; the vulnerable component accepts remote POST requests and processes a client-supplied filename or path without adequately normalizing traversal sequences such as ../, so an attacker can escape the intended upload or deployment directory and write files to arbitrary locations on the filesystem. Because the affected service appears to run with elevated privileges, the write primitive converts directly into code execution as root when the attacker places a webshell in a location the service or web tier will process (a path-traversal-to-RCE chain typical of file-upload handlers that trust client-supplied paths). The authentication profile is confirmed from the CVSS vector (PR:N in both the vendor 4.0 vector and our assessed 3.1 vector), and no user interaction or non-default configuration is required (UI:N, AT:N per vendor; AC:L). Affected-version data from EUVD lists the product range as MSEC 0 and later ("0 <*"), indicating the issue is not tied to a single tagged release; no CPE strings were supplied, so exact product identification should be confirmed against the upstream repository at https://github.com/Tencent/MSEC.
Know when Tencent gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Remote unauthenticated path traversal yielding root code execution gives AV:N/AC:L/PR:N/UI:N with full C/I/A impact; scope unchanged as compromise stays on the target host.
Primary rating from Vendor (9119a7d8-5eab-497f-8521-727c672e3725).
CVSS VectorVendor: 9119a7d8-5eab-497f-8521-727c672e3725
DescriptionCVE.org
Tencent Mass Service Engine in Cluster (MSEC) allows a remote, unauthenticated attacker to send a crafted POST request including ../ and gain root access on the target device. An attacker who uploads a webshell can execute arbitrary code as root.
Executive ViewAI
Tencent Mass Service Engine in Cluster (MSEC), an open-source distributed backend framework, contains a critical unauthenticated remote code execution vulnerability (CVE-2026-89040) that lets a network-positioned attacker upload a webshell via path traversal and run commands as root on the host. Exposure is confined to environments that actually deploy MSEC and expose its HTTP request-handling and upload service to untrusted networks, but any such host can be fully compromised without credentials or user interaction. No vendor-released patch has been identified at time of analysis and no public exploit has been identified at time of analysis, so leadership should prioritize locating and isolating any internet- or partner-facing MSEC instances before exploitation activity appears.
No vendor-released patch identified at time of analysis. Interim mitigations: network-isolate or firewall-block MSEC HTTP/upload service from untrusted networks; disable the file-upload endpoint if not business-critical; deploy WAF/reverse-proxy rules that reject '../' and encoded traversal sequences in upload filenames and paths; run the MSEC service as a non-root, least-privilege account; segment MSEC hosts from sensitive systems; monitor and alert on anomalous file writes to web-accessible directories and unexpected child processes.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
WeKnora LLM framework (before 0.2.5) allows authenticated users to inject MCP stdio commands that the server executes as
OS command injection in WeKnora from version 0.2.5 allows authenticated users to execute arbitrary system commands. CVSS
SQL injection in WeKnora LLM document understanding framework allows authenticated users to extract arbitrary database c
vConsole v3.15.0 was discovered to contain a prototype pollution due to incorrect key and value resolution in setOptions
Insufficient authorization checks in WeKnora's tenant management endpoints allow any authenticated user to read, modify,
Insecure Permissions vulnerability in Tencent wechat v.8.0.37 allows an attacker to escalate privileges via the web-view
Tencent Blueking CMDB v3.2.x to v3.9.x was discovered to contain a Server-Side Request Forgery (SSRF) via the event subs
Tencent GameLoop before 4.1.21.90 downloaded updates over an insecure HTTP connection. Rated high severity (CVSS 8.1), t
In Tencent QQ through 9.7.8.29039 and TIM through 3.4.7.22084, QQProtect.exe and QQProtectEngine.dll do not validate poi
HaboMalHunter through 2.0.0.3 in Tencent Habo allows attackers to evade dynamic malware analysis via PIE compilation. Ra
Tencent tdsqlpcloud through 1.8.5 allows unauthenticated remote attackers to discover database credentials via an index.
A vulnerability in the lua parser of TscanCode tsclua v2.15.01 allows attackers to cause a Denial of Service (DoS) via a
Exploit-DB