PT-2026-21655 · Unknown · Hummerrisk

Ana10Gy · Publicado 2026-02-24 · Atualizado 2026-02-24 · CVE-2026-3064

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HummerRisk versions up to 1.5.0

Description A security issue exists in HummerRisk that allows for command injection. This is due to manipulation of the regionId argument within the ResourceCreateService.java file of the Cloud Task Scheduler component. The attack can be launched remotely, and the exploit has been publicly disclosed. The vendor was informed of the disclosure but did not respond.

Recommendations Versions prior to 1.5.0 should be updated. As a temporary workaround, consider restricting access to the Cloud Task Scheduler component to minimize the risk of exploitation.

Exploit

Correção

Command Injection

Special Elements Injection

Enumeração de Fraquezas

CWE-77

CWE-74

Identificadores relacionados

CVE-2026-3064

Produtos afetados

Hummerrisk

Referências · 9

• 🔥 https://github.com/AnalogyC0de/public_exp/issues/8 · Exploit
• https://twitter.com/CVEnew/status/2026184608224838103 · Publicação no Twitter
• https://vuldb.com/?submit.757695 · Nota
• https://vuldb.com/?ctiid.347415 · Nota
• https://t.me/CVEtracker/45556 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-3064 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2026281843935314056 · Publicação no Twitter
• https://vuldb.com/?id.347415 · Nota
• https://osv.dev/vulnerability/CVE-2026-3064 · Aviso do Fabricante