CVE-2026-23920

CVE-2026-23920 is a command injection vulnerability (CWE-78) allowing authenticated users to bypass administrator-defined regex input validation in host and event action scripts by injecting a newline character. This flaw enables the injection of shell commands, though no specific affected products are currently identified. Rated High severity (CVSS 7.7), exploitation requires low privileges and the attacker to be present at the target system, resulting in high impacts on confidentiality, integrity, and availability. There is currently no public exploit code, evidence of active exploitation, or significant community discussion or media coverage.