CVE-2026-4786

CVE-2026-4786 is a bypass vulnerability affecting products that use the webbrowser.open() API, resulting from incomplete mitigation of CVE-2026-4519. The flaw allows attackers to bypass previous security patches by crafting URLs containing "%action" strings, which can lead to arbitrary command injection into the underlying shell on certain browser types. This vulnerability represents a second-order attack that exploits gaps in the initial remediation effort. The attack vector is network-based and requires user interaction through a crafted URL, suggesting low to medium complexity for exploitation. The potential impact includes arbitrary command execution with the privileges of the affected application, though the CVSS score is not currently available for precise severity assessment. The FAUCET Risk Score of 46.0/100 indicates moderate concern. There is currently no evidence of active exploitation in the wild, as the vulnerability is not listed on the Known Exploited Vulnerabilities catalog and remains inactive on threat tracking lists. The EPSS score of 0.0002 indicates minimal probability of exploitation within the next 30 days. Community attention appears limited, suggesting either recent disclosure or low visibility within security circles at this time.