Detections
Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-84837

critical Nessus Plugin ID 342382

Synopsis

The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.

Description

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

 - A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by `rpmbuild -t*` to include shell metacharacters. This is particularly relevant in automated build or continuous integration (CI) workflows that ingest externally supplied artifact names. Successful exploitation allows for arbitrary command execution with the privileges of the build user, which could lead to information disclosure or disruption of the build environment.
 (CVE-2026-84837)

Note that Nessus relies on the presence of the package as reported by the vendor.

Solution

There is no known solution at this time.

See Also

https://access.redhat.com/security/cve/cve-2026-84837

Plugin Details

Severity: Critical

ID: 342382

File Name: unpatched_CVE_2026_84837.nasl

Version: 1.1

Type: Local

Agent: unix

Family: Misc.

Published: 9/2/2026

Updated: 9/2/2026

Supported Sensors: Nessus Agent, Nessus

Risk Information

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2026-84837

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:U/RC:C

Vulnerability Information

CPE: cpe:/o:centos:centos:7, cpe:/o:centos:centos:8, cpe:/o:redhat:enterprise_linux:10, cpe:/o:redhat:enterprise_linux:7, cpe:/o:redhat:enterprise_linux:8, cpe:/o:redhat:enterprise_linux:9, p-cpe:/a:centos:centos:python3-rpm, p-cpe:/a:centos:centos:rpm-apidocs, p-cpe:/a:centos:centos:rpm-build-libs, p-cpe:/a:centos:centos:rpm-build, p-cpe:/a:centos:centos:rpm-cron, p-cpe:/a:centos:centos:rpm-devel, p-cpe:/a:centos:centos:rpm-libs, p-cpe:/a:centos:centos:rpm-plugin-audit, p-cpe:/a:centos:centos:rpm-plugin-dbus-announce, p-cpe:/a:centos:centos:rpm-plugin-fapolicyd, p-cpe:/a:centos:centos:rpm-plugin-ima, p-cpe:/a:centos:centos:rpm-plugin-prioreset, p-cpe:/a:centos:centos:rpm-plugin-selinux, p-cpe:/a:centos:centos:rpm-plugin-syslog, p-cpe:/a:centos:centos:rpm-plugin-systemd-inhibit, p-cpe:/a:centos:centos:rpm-python, p-cpe:/a:centos:centos:rpm-sign-libs, p-cpe:/a:centos:centos:rpm-sign, p-cpe:/a:centos:centos:rpm, p-cpe:/a:redhat:enterprise_linux:python3-rpm, p-cpe:/a:redhat:enterprise_linux:rpm-apidocs, p-cpe:/a:redhat:enterprise_linux:rpm-build-libs, p-cpe:/a:redhat:enterprise_linux:rpm-build, p-cpe:/a:redhat:enterprise_linux:rpm-cron, p-cpe:/a:redhat:enterprise_linux:rpm-devel, p-cpe:/a:redhat:enterprise_linux:rpm-libs, p-cpe:/a:redhat:enterprise_linux:rpm-plugin-audit, p-cpe:/a:redhat:enterprise_linux:rpm-plugin-dbus-announce, p-cpe:/a:redhat:enterprise_linux:rpm-plugin-fapolicyd, p-cpe:/a:redhat:enterprise_linux:rpm-plugin-ima, p-cpe:/a:redhat:enterprise_linux:rpm-plugin-prioreset, p-cpe:/a:redhat:enterprise_linux:rpm-plugin-selinux, p-cpe:/a:redhat:enterprise_linux:rpm-plugin-syslog, p-cpe:/a:redhat:enterprise_linux:rpm-plugin-systemd-inhibit, p-cpe:/a:redhat:enterprise_linux:rpm-python, p-cpe:/a:redhat:enterprise_linux:rpm-sign-libs, p-cpe:/a:redhat:enterprise_linux:rpm-sign, p-cpe:/a:redhat:enterprise_linux:rpm

Required KB Items: Host/cpu, Host/local_checks_enabled, global_settings/vendor_unpatched, Host/OS/identifier

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 9/2/2026

Reference Information

CVE: CVE-2026-84837