PT-2026-32620 · Unknown · Upkeeper Instant Privilege Access

Tony Nilsson · Published 2026-04-14 · Updated 2026-04-19 · CVE-2026-2449

Positive Technologies (AI Summary)

CVSS v4.0

9.0

Critical

Base vector

AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions upKeeper Instant Privilege Access versions prior to 1.5.0

Description Improper neutralization of argument delimiters in a command, known as argument injection, allows low-privilege users to hijack a privileged thread of execution. This can lead to privilege escalation across systems, potentially granting root access.

Recommendations Update to a version newer than 1.5.0.

Fix

LPE

Argument Injection

Weakness Enumeration

CWE-88

Related Identifiers

CVE-2026-2449

Affected Products

Upkeeper Instant Privilege Access

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-2449 · Security Note
• https://twitter.com/NewsNerdie/status/2044113980763873766 · Twitter Post
• https://twitter.com/CVEnew/status/2045972386097578296 · Twitter Post
• https://twitter.com/0dayPublishing/status/2044025286098813263 · Twitter Post
• https://support.upkeeper.se/hc/en-us/articles/26783425404444-CVE-2026-2449-Improper-neutralization-of-argument-delimiters-in-a-command · Note