PT-2026-82599

CVE-2026-81698

Published

2026-08-27

Updated

2026-09-01

Description by

CVSS 4.0

9.3

Critical

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions openssl encrypt versions prior to 1.4.9

Description A shell injection issue exists in the info command's reconstructed CLI block. The system interpolates untrusted metadata fields without proper quoting, allowing attackers to craft metadata values, such as pepper name, containing shell commands. These commands are executed when a user copies and pastes the printed CLI block into a shell.

Recommendations Update to version 1.4.9 or later.

Exploitability

Exploit

Fix

Impacts

Vendors

Affected products

Weakness enumeration

CWE-78: Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\')

Related identifiers

CVE-2026-81698

GHSA-GW2M-MJ6Q-59HC