{"id":"CVE-2025-40763","aliases":["EUVD-2025-106751","GHSA-3988-jj2m-p6m7"],"status":"published","title":"A vulnerability has been identified in Altair Grid Engine (All versions \u003c V2026.0.0). Affected...","description":"A vulnerability has been identified in Altair Grid Engine (All versions \u003c V2026.0.0). Affected products do not properly validate environment variables when loading shared libraries, allowing path hijacking through malicious library substitution.\r\nThis could allow a local attacker to execute arbitrary code with superuser privileges by manipulating the environment variable and placing a malicious library in the controlled path.","severity":{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00148,"percentile":0.04008,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-427"],"published":"2025-11-11T20:20:36Z","modified":"2026-10-18T20:10:00Z","products":[{"vendor":"siemens","product":"altair grid engine"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-514895.html"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40763"},{"url":"https://github.com/advisories/GHSA-3988-jj2m-p6m7"}],"sources":{"cve":[{"id":"CVE-2025-40763","description":"A vulnerability has been identified in Altair Grid Engine (All versions \u003c V2026.0.0). Affected products do not properly validate environment variables when loading shared libraries, allowing path hijacking through malicious library substitution.\r\nThis could allow a local attacker to execute arbitrary code with superuser privileges by manipulating the environment variable and placing a malicious library in the controlled path.","status":"published","published":"2025-11-11T20:20:36.755Z","modified":"2025-11-12T18:41:52.671Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-427"],"updated_at":"2026-11-02T14:32:34.434755Z"}],"euvd":[{"id":"EUVD-2025-106751","description":"A vulnerability has been identified in Altair Grid Engine (All versions \u003c V2026.0.0). Affected products do not properly validate environment variables when loading shared libraries, allowing path hijacking through malicious library substitution.\r\nThis could allow a local attacker to execute arbitrary code with superuser privileges by manipulating the environment variable and placing a malicious library in the controlled path.","status":"published","published":"2025-11-11T20:20:36Z","modified":"2025-11-12T18:41:52Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T19:49:18.397537Z"}],"ghsa":[{"id":"GHSA-3988-jj2m-p6m7","title":"A vulnerability has been identified in Altair Grid Engine (All versions \u003c V2026.0.0). Affected...","description":"A vulnerability has been identified in Altair Grid Engine (All versions \u003c V2026.0.0). Affected products do not properly validate environment variables when loading shared libraries, allowing path hijacking through malicious library substitution.\nThis could allow a local attacker to execute arbitrary code with superuser privileges by manipulating the environment variable and placing a malicious library in the controlled path.","status":"published","published":"2025-11-11T21:30:28Z","modified":"2025-11-11T21:30:39Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-427"],"updated_at":"2026-11-02T15:04:45.192533Z"}],"nvd":[{"id":"CVE-2025-40763","description":"A vulnerability has been identified in Altair Grid Engine (All versions \u003c V2026.0.0). Affected products do not properly validate environment variables when loading shared libraries, allowing path hijacking through malicious library substitution.\r\nThis could allow a local attacker to execute arbitrary code with superuser privileges by manipulating the environment variable and placing a malicious library in the controlled path.","status":"published","published":"2025-11-11T21:15:37.893Z","modified":"2026-10-18T20:10:00.11Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-427"],"updated_at":"2026-11-02T14:11:43.650381Z"}]}}