How severe is CVE-2026-8914?

CVE-2026-8914 has a CVSS 4.0 base score of 8.4, rated high severity.

Is CVE-2026-8914 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (42nd percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2026-8914?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

Does CVE-2026-8914 have an EU (EUVD) identifier?

Yes. CVE-2026-8914 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-34794.

When was CVE-2026-8914 published?

CVE-2026-8914 was published on 2026-06-05 and last updated on 2026-06-17.

CVE-2026-8914

CVE-2026-8914 is a high-severity vulnerability with a CVSS 4.0 base score of 8.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-95.

Key facts

Severity: High (CVSS 4.0 base score 8.4)
EPSS exploit prediction: 1% (42nd percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-34794
Weakness: CWE-95
Published: 2026-06-05
Last modified: 2026-06-17

Description

In Teltonika Networks RUTOS devices, running versions 7.22 through 7.23.2 and TSWOS devices running versions 1.09 through 1.09.1, due to unsafe calls to an eval function in rpc-profile, a vulnerability exists where a lower privileged user could perform command injection as the root user.

Frequently asked questions

What is CVE-2026-8914?: In Teltonika Networks RUTOS devices, running versions 7.22 through 7.23.2 and TSWOS devices running versions 1.09 through 1.09.1, due to unsafe calls to an eval function in rpc-profile, a vulnerability exists where a lower privileged user could perform command injection as the root user.
How severe is CVE-2026-8914?: CVE-2026-8914 has a CVSS 4.0 base score of 8.4, rated high severity.
Is CVE-2026-8914 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (42nd percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2026-8914?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2026-8914 have an EU (EUVD) identifier?: Yes. CVE-2026-8914 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-34794.
When was CVE-2026-8914 published?: CVE-2026-8914 was published on 2026-06-05 and last updated on 2026-06-17.

References

https://www.teltonika-networks.com/support/security-centre

Other CWE-95 (Eval Injection) vulnerabilities

CVE-2026-44643 — Critical (CVSS 10.0): Angular Expressions provides expressions for the Angular.JS web framework as a standalone module. Prior to 1.5.2, an…
CVE-2025-68271 — Critical (CVSS 10.0): OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems.…
CVE-2013-10070 — Critical (CVSS 10.0): PHP-Charts v1.0 contains a PHP code execution vulnerability in wizard/url.php, where user-supplied GET parameter names…
CVE-2022-36010 — Critical (CVSS 10.0): This library allows strings to be parsed as functions and stored as a specialized component,…
CVE-2026-1470 — Critical (CVSS 9.9): n8n contains a critical Remote Code Execution (RCE) vulnerability in its workflow Expression evaluation system.…
CVE-2023-29511 — Critical (CVSS 9.9): XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with…

Browse all CWE-95 (Eval Injection) vulnerabilities →