← Back to the live CVE advisory feed

CVE-2026-85199: Product identification pending

Severity

8.8 (HIGH)

Vendor

ECLIPSE

Affected versions

Before 1.2.1

Fixed version

1.2.1

Patch status

Patched

Published

2026-09-03T15:17:39.937

Modified

2026-09-03T15:17:39.937

Why it matters

This matters because the affected product may allow code execution. Prioritize systems that are internet-facing or have privileged access to other infrastructure.

Recommended admin actions

• Review and patch based on exposure, asset criticality, and business impact.
• Compare installed versions against the affected version range in the advisory.
• Treat internet-facing systems as higher priority.
• Review logs for suspicious activity related to the affected application or component.

Technical summary

Eclipse aeriOS Self-orchestrator versions prior to 1.2.1 contain a path traversal vulnerability in the REST API. User-controlled identifiers used to create, update, or delete Self-orchestrator resources were incorporated into filesystem paths without adequate validation or sanitization. An unauthenticated remote attacker able to access the Self-orchestrator API could therefore supply specially crafted identifiers containing path traversal sequences to write or delete JSON files outside the intended application directories, subject to the filesystem permissions of the Self-orchestrator process. The impact is increased by the absence of authentication on the affected API and by the container running with elevated privileges in the affected deployment configuration. The issue has been addressed in version 1.2.1 by introducing validation and sanitization of user-controlled identifiers before they are used to construct filesystem paths, preventing path separator characters from being used to escape the intended directories.

View the official NVD record for CVE-2026-85199

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.