CVE-2026-36829 @ morris

"CVE-2026-36829"
"filesystem"
"Am I vulnerable?"

Status

does_not_affect

Priority

7.96

Match score

2.5

Risk

AuthBypass

CVSS

9.8 CRITICAL

Reason

packages: filesystem

Created

2026-08-02T02:51:45Z

Updated

2026-08-02T08:45:16Z

Closed

2026-08-02T08:45:16Z

Package interrogation (copy)

Run on the host — click to copy a command. RPM

Package	Commands
filesystem

Inventory lookup

Search package inventory across systems, then return here. Create a ticket on systems the matcher missed.

Suggestions: filesystem

System	Matches	Ticket for CVE-2026-36829
morris	emacs-filesystem 24.3; filesystem 3.2; firebird-filesystem 2.5.9.27139.0; firewalld-filesystem 0.6.3; fontpackages-filesystem 1.44; plesk-libboost-filesystem1.65 1.65.1; plesk-libboost-filesystem1.74 1.74.0.1; plesk-libboost-filesystem1.82 1.82.0 (+1 more)	does_not_affect open
mufasa	emacs-filesystem 24.3; filesystem 3.2; firebird-filesystem 2.5.9.27139.0; firewalld-filesystem 0.6.3; fontpackages-filesystem 1.44; libreport-filesystem 2.1.11; plesk-libboost-filesystem1.74 1.74.0.1; plesk-libboost-filesystem1.82 1.82.0 (+2 more)	does_not_affect open
Helios	libboost-filesystem1.74.0 1.74.0-9	none
Saiph	libboost-filesystem1.55.0 1.55.0+dfsg-3; libboost-filesystem1.62.0 1.62.0+dfsg-4	none

Same product CVEs in your queue

Other tickets that look like the same product (from match reason). Relate them here to triage this CVE as the primary.

CVE	CVSS	Systems	Status	Matched	Already related
CVE-2026-67429	10.0	morris, mufasa	does_not_affect	filesystem	—
CVE-2026-45661	9.9	morris, mufasa	does_not_affect	filesystem	—
CVE-2026-68770	9.8	morris, mufasa	does_not_affect	filesystem	—
CVE-2025-40212	9.8	morris, mufasa	not_applicable	filesystem	—
CVE-2026-25879	9.8	morris, mufasa	does_not_affect	filesystem	—
CVE-2026-47162	8.8	Archive, Janus, Library, Matrix, Saiph	accepted_risk	filesystem	—
CVE-2023-4692	7.5	Archive, Janus, Library, Saiph, morris …	accepted_risk, fixed	filesystem	—

Related CVE (same fix)

Point this ticket’s CVE at a higher-priority / same-fix primary so you only triage one.

Host OS / kernel

CloudLinux release 7.9 (Boris Yegorov) (7.9) · cloudlinux

Arch

x86_64

kernel_release

uname -r → 3.10.0-962.3.2.lve1.5.89.el7.x86_64

kernel_version

uname -v → #1 SMP Thu Jul 9 15:55:31 UTC 2026

For Linux kernel CVEs, kernel_version (Debian packaging / build string) often decides fixed vs not; kernel_release is used for upstream NVD range compares.

Same CVE on other hosts

Open the ticket for this CVE on another system.

System	Status	Priority	Updated
mufasa	does_not_affect	7.96	2026-08-02T08:45:24Z	Open

Description

An authentication bypass vulnerability exists in the embedded HTTP server of Panabit PAP-XM320 up to and including v7.7. The server validates session cookies using a filesystem existence check based on a user-controlled cookie value without proper sanitization, allowing directory traversal and bypass of authentication.

Update status

Add note only

References

NVD: CVE-2026-36829