CVE-2026-5789

CVE-2026-5789 is an unquoted search path vulnerability affecting CivetWeb v1.16 that enables local attackers to achieve arbitrary code execution with elevated privileges. The flaw exists because the service configuration lacks proper path quoting, allowing an attacker to place a malicious executable in a directory that is searched before the legitimate application path at C:\Program Files\CivetWeb\CivetWeb.exe. The vulnerability carries a HIGH CVSS score of 7.8, indicating significant risk potential. The attack requires local access and low privilege user rights but is relatively straightforward to execute due to low attack complexity. Successful exploitation grants the attacker complete system compromise through elevated code execution, impacting confidentiality, integrity, and availability. Currently, CVE-2026-5789 shows no active exploitation in the wild, with no publicly available exploit code reported and low community attention as evidenced by its inactive status on the KEV and Hot List databases. The EPSS score of 0.00013 reflects minimal real-world exploitation likelihood, though organizations running CivetWeb v1.16 should still prioritize patching due to the severity of potential impact.