Wind River VxWorks 7: Improper privilege management in command shell
Summary
A flaw in the command shell of Wind River VxWorks 7 allows commands to run without the usual privilege check when per-user command privileges are configured. An authenticated user with limited privileges can therefore execute commands they are not authorized to run, which can lead to privilege escalation with impact on confidentiality, integrity and availability. The vendor record does not state that the flaw is reachable from the internet.
Affected
- Wind River VxWorks 7 prior to 26.09 when per-user command privileges are configured
- Devices with other VxWorks 7 builds: Unknown.
- Note: one source gives the range as all versions up to 26.09; the vendor advisory must confirm.
Fixed in
- Fixed in VxWorks 26.09
- Fixes for older branches or device firmware: Unknown.
Workaround
Unknown. No vendor workaround is documented.
- Interim measure (not from the vendor): restrict shell and console access, keep management interfaces off untrusted networks, and review low-privilege accounts.
Exploitation
- No evidence of exploitation in the wild found.
- CISA KEV: not listed according to one aggregator (not checked directly).
- No public proof-of-concept found.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- EPSS 0.00636 (snapshot, may be outdated).
Our recommendation
- Identify VxWorks 7 devices in your inventory and check their firmware against 26.09.
- Ask device vendors for firmware update schedules and confirm whether per-user command privileges are enabled.
- Restrict shell and management access to trusted networks and accounts.
- Check the Wind River advisory and NVD for the final affected range and recheck KEV in the coming weeks.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Wind River Support: CVE-2026-104018 support2.windriver.com
- VulDB: CVE-2026-104018 vuldb.com
- OpenCVE: CVE-2026-104018 app.opencve.io
- VulnCheck/Vulners: CVE-2026-104018 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 22:55.
Original description (NVD)
An improper privilege management vulnerability (CWE-269) exists in the command shell of Wind River VxWorks 7 when configured to enforce per-user command privileges. Under certain shell operations, a command may be evaluated without the privilege check that is normally applied, allowing an authenticated user with limited privileges to execute commands they are not authorized to run. Successful exploitation can result in privilege escalation, with impact to the confidentiality, integrity, and availability of the affected device. The issue affects all versions of VxWorks 7 prior to 26.09. It has been fixed in 26.09.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.