PT-2025-46540 · Altair · Altair Grid Engine

Published 2025-11-11 · Updated 2025-11-11 · CVE-2025-40763

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Altair Grid Engine versions prior to 2026.0.0

Description The software does not properly validate environment variables when loading shared libraries, which can allow for path hijacking through malicious library substitution. A local attacker could potentially execute arbitrary code with superuser privileges by manipulating the environment variable and placing a malicious library in a controlled path.

Recommendations Update to version 2026.0.0 or later.

Fix

LPE

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

BDU:2026-05805

CVE-2025-40763

Affected Products

Altair Grid Engine

References · 6

• https://bdu.fstec.ru/vul/2026-05805 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-40763 · Security Note
• https://twitter.com/CVEnew/status/1988348963649474946 · Twitter Post
• https://cert-portal.siemens.com/productcert/html/ssa-514895.html · Note
• https://windowsforum.com/threads/siemens-altair-grid-engine-local-vulnerabilities-patch-cve-2025-40760-and-cve-2025-40763.389277 · Note
• https://t.me/CVEtracker/37085 · Telegram Post