CVE-2026-26046
Published: 21 February 2026
Summary
CVE-2026-26046 is a high-severity OS Command Injection (CWE-78) vulnerability in Moodle Moodle. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 35.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Threat & Defense at a Glance
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection (CWE-78) in public-facing Moodle admin settings directly enables OS command execution via Unix shell after obtaining admin access.
NVD Description
A vulnerability was found in a Moodle TeX filter administrative setting where insufficient sanitization of configuration input could allow command injection. On sites where the TeX filter is enabled and ImageMagick is installed, a maliciously crafted setting value entered by…
more
an administrator could result in unintended system command execution. While exploitation requires administrative privileges, successful compromise could affect the entire Moodle server.
Deeper analysisAI
CVE-2026-26046 is a command injection vulnerability (CWE-78) in the Moodle TeX filter administrative setting due to insufficient sanitization of configuration input. It affects Moodle sites where the TeX filter is enabled and ImageMagick is installed. Published on 2026-02-21, the vulnerability carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
Exploitation requires administrative privileges on the targeted Moodle instance. An attacker with admin access can submit a maliciously crafted setting value, resulting in unintended system command execution. Successful exploitation could compromise the entire Moodle server, enabling high-impact confidentiality, integrity, and availability violations.
Red Hat security advisories provide further details, including at https://access.redhat.com/security/cve/CVE-2026-26046 and the associated Bugzilla entry at https://bugzilla.redhat.com/show_bug.cgi?id=2440903. Security practitioners should review these resources for patch availability and recommended mitigations.
Details
- CWE(s)