{"id":"CVE-2026-90999","aliases":["EUVD-2026-80853","GHSA-vh55-q5m4-8wr6"],"status":"published","title":"Sentry Seer vulnerability allows attacker-controlled input to be executed in a privileged environment","description":"Sentry Seer is vulnerable to a multi-stage trust-boundary violation that allows unauthenticated attacker-controlled telemetry to become code that is executed by an agent in a privileged automation environment. An external attacker can submit fabricated Sentry events without having access to the victim’s Sentry account, source repository, or infrastructure.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.0067,"percentile":0.52497,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-116","CWE-20","CWE-74","CWE-913","CWE-94"],"published":"2026-09-16T15:45:47Z","modified":"2026-09-18T17:49:08Z","products":[{"vendor":"functional software, inc.","product":"sentry seer"}],"references":[{"url":"https://kb.cert.org/vuls/id/212479"},{"url":"https://www.kb.cert.org/vuls/id/212479"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90999"},{"url":"https://github.com/advisories/GHSA-vh55-q5m4-8wr6"}],"sources":{"cve":[{"id":"CVE-2026-90999","title":"Sentry Seer vulnerability allows attacker-controlled input to be executed in a privileged environment","description":"Sentry Seer is vulnerable to a multi-stage trust-boundary violation that allows unauthenticated attacker-controlled telemetry to become code that is executed by an agent in a privileged automation environment. An external attacker can submit fabricated Sentry events without having access to the victim’s Sentry account, source repository, or infrastructure.","status":"published","published":"2026-09-16T15:45:47.463Z","modified":"2026-09-18T13:40:22.164Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-20","CWE-74","CWE-116","CWE-94","CWE-913"],"updated_at":"2026-11-02T13:45:36.695039Z"}],"euvd":[{"id":"EUVD-2026-80853","description":"Sentry Seer is vulnerable to a multi-stage trust-boundary violation that allows unauthenticated attacker-controlled telemetry to become code that is executed by an agent in a privileged automation environment. An external attacker can submit fabricated Sentry events without having access to the victim’s Sentry account, source repository, or infrastructure.","status":"published","published":"2026-09-16T15:45:47Z","modified":"2026-09-18T13:40:22Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T17:28:08.898956Z"}],"ghsa":[{"id":"GHSA-vh55-q5m4-8wr6","title":"Sentry Seer is vulnerable to a multi-stage trust-boundary violation that allows unauthenticated...","description":"Sentry Seer is vulnerable to a multi-stage trust-boundary violation that allows unauthenticated attacker-controlled telemetry to become code that is executed by an agent in a privileged automation environment. An external attacker can submit fabricated Sentry events without having access to the victim’s Sentry account, source repository, or infrastructure.","status":"published","published":"2026-09-16T18:32:03Z","modified":"2026-09-18T15:33:03Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:12:10.765995Z"}],"nvd":[{"id":"CVE-2026-90999","description":"Sentry Seer is vulnerable to a multi-stage trust-boundary violation that allows unauthenticated attacker-controlled telemetry to become code that is executed by an agent in a privileged automation environment. An external attacker can submit fabricated Sentry events without having access to the victim’s Sentry account, source repository, or infrastructure.","status":"published","published":"2026-09-16T16:17:21.817Z","modified":"2026-09-18T17:49:08.457Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-20","CWE-74","CWE-94","CWE-116","CWE-913"],"updated_at":"2026-11-02T14:12:48.630594Z"}]}}