CVE-2026-2399

CVE-2026-2399 is a path traversal vulnerability (CWE-22) affecting Web Admin functionality in unspecified products that allows critical system files to be overwritten with arbitrary text data through manipulation of POST requests to the /REST/upssleep endpoint. The vulnerability requires an authenticated Web Admin user to exploit, making it a privilege abuse scenario rather than an unauthenticated attack vector. The vulnerability carries a CVSS v3.1 score of 6.1 (Medium), with an adjacent network attack vector and low complexity. While confidentiality is not impacted, the vulnerability poses significant integrity and availability risks through unauthorized file overwriting of critical system components. The FAUCET Risk Score of 34.0 out of 100 indicates moderate concern from a holistic risk perspective. There is currently no evidence of active exploitation in the wild. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog and remains inactive on threat intelligence hot lists. The extremely low EPSS score of 0.00024 suggests minimal real-world exploitation probability, indicating this is likely a lower-priority remediation item relative to higher-severity threats, though patching should still be scheduled as part of routine maintenance cycles.