Cyber Posture

CVE-2026-26046

HighRCE

Published: 21 February 2026

Published
21 February 2026
Modified
26 February 2026
KEV Added
Patch
CVSS Score 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0015 35.7th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-26046 is a high-severity OS Command Injection (CWE-78) vulnerability in Moodle Moodle. Its CVSS base score is 7.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 35.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique.
Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-78

Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.

addresses: CWE-78

Validates inputs to block special elements that would alter OS command execution.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
Why these techniques?

Command injection (CWE-78) in public-facing Moodle admin settings directly enables OS command execution via Unix shell after obtaining admin access.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

A vulnerability was found in a Moodle TeX filter administrative setting where insufficient sanitization of configuration input could allow command injection. On sites where the TeX filter is enabled and ImageMagick is installed, a maliciously crafted setting value entered by…

more

an administrator could result in unintended system command execution. While exploitation requires administrative privileges, successful compromise could affect the entire Moodle server.

Deeper analysisAI

CVE-2026-26046 is a command injection vulnerability (CWE-78) in the Moodle TeX filter administrative setting due to insufficient sanitization of configuration input. It affects Moodle sites where the TeX filter is enabled and ImageMagick is installed. Published on 2026-02-21, the vulnerability carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

Exploitation requires administrative privileges on the targeted Moodle instance. An attacker with admin access can submit a maliciously crafted setting value, resulting in unintended system command execution. Successful exploitation could compromise the entire Moodle server, enabling high-impact confidentiality, integrity, and availability violations.

Red Hat security advisories provide further details, including at https://access.redhat.com/security/cve/CVE-2026-26046 and the associated Bugzilla entry at https://bugzilla.redhat.com/show_bug.cgi?id=2440903. Security practitioners should review these resources for patch availability and recommended mitigations.

Details

CWE(s)

Affected Products

moodle
moodle
≤ 4.5.9 · 5.0.0 — 5.0.5 · 5.1.0 — 5.1.2

CVEs Like This One

CVE-2025-26533Same product: Moodle Moodle
CVE-2025-26530Same product: Moodle Moodle
CVE-2025-67848Same product: Moodle Moodle
CVE-2025-67850Same product: Moodle Moodle
CVE-2025-67853Same product: Moodle Moodle
CVE-2025-26525Same product: Moodle Moodle
CVE-2025-67847Same product: Moodle Moodle
CVE-2026-26045Same product: Moodle Moodle
CVE-2025-26529Same product: Moodle Moodle
CVE-2025-67856Same product: Moodle Moodle

References