AUGUST 15, 2026
Live Feed
Back to database
Case File

CVE-2026-72590

CRITICAL · CVSS 9.8 EPSS 1.28% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-08-10 · Last synced 2026-08-15

CyberRota Analysis

AI-Generated

An OS command injection vulnerability in alseambusher/crontab-ui versions prior to 0.4.2 allows unauthenticated remote attackers to inject arbitrary cron job entries via a crafted GET request, exploiting the improper handling of newline characters in the env_vars parameter. This could lead to the execution of malicious commands on the affected system, posing a critical risk to system integrity and availability. Organizations using this software should prioritize immediate patching to mitigate potential exploitation.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-72590
Severity
CRITICAL
CVSS
9.8
EPSS
1.28%

Original NVD Description

An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to inject arbitrary cron job entries by sending a crafted GET request to /crontab with URL-encoded newlines in the env_vars parameter.