CVE-2026-73787: Authenticated Arbitrary File Write allows Remote Code Execution via CPPM Web Interface
Published Sep 9, 2026
·Updated
A vulnerability in the CPPM web interface could allow an authenticated remote attacker to access directory information on a vulnerable system. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
Affected Software
1 affected component
CPPM Web Interface
Event History
Sep 9, 2026
CVE Published
via MITRE·07:14 PM
Data Sourced
via MITRE·07:14 PM
DescriptionSeverity
Frequently Asked Questions
1
What access does an attacker need to exploit this issue?
The attacker must be authenticated to the CPPM web interface and have high privileges. Exploitation can be performed remotely over the network and does not require user interaction.
2
Which deployments are exposed?
Deployments with a network-accessible CPPM web interface are in scope, provided an attacker can obtain authenticated high-privilege access.