CVE-2026-14736: Ruijie RG-UAC user_auth_commit.php unrestricted upload
A vulnerability was found in Ruijie RG-UAC up to 1.0-R1.8.2.p5. The impacted element is an unknown function of the file userauthcommit.php. Performing a manipulation of the argument uploadimage results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made public and could be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ruijie RG-UACto a version that resolves this vulnerability.Fixed in 1.0-R1.8.2.p5 - Compensating control
Restrict remote access to the endpoint/function handling uploads in user_auth_commit.php (user_auth_commit.php upload_image argument) so only trusted clients can reach it.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14736?
CVE-2026-14736 has a high severity level of 7.3.
How do I fix CVE-2026-14736?
To mitigate CVE-2026-14736, update Ruijie RG-UAC to the latest version that addresses this vulnerability.
What type of vulnerability is CVE-2026-14736?
CVE-2026-14736 is classified as a malicious file upload vulnerability.
Can CVE-2026-14736 be exploited remotely?
Yes, CVE-2026-14736 can be exploited remotely.
What impact does CVE-2026-14736 have on security?
CVE-2026-14736 could allow an attacker to upload malicious files, leading to potential unauthorized access or data compromise.