CVE-2026-109556 (CVSS 8)

Description

EdgeEver Desktop 1.92.0 through 1.112.0 contains a remote code execution vulnerability in the desktop:acp-probe IPC handler, which lacks a sender check and spawns a caller-supplied input.path executable. Attackers with script execution in a renderer, such as via template-preview or drag-preview stored cross-site scripting, can call probeAcpAdapter to launch local executables with the user's privileges.

Is your site exposed to CVE-2026-109556?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

8.0

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

EPSS — Exploit Prediction

0.0065

Probability of exploitation

0.52%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Weakness Type (CWE)

CWE-749 CWE-749

References

Other References

https://github.com/tianma-if/edgeever https://github.com/tianma-if/edgeever/blob/f6ade70423ba366077653dbb8ac43a677933c776/apps/desktop/src/main/acp-host.mjs#L1145 https://github.com/tianma-if/edgeever/commit/6b5027e8b4becbee0c0de7cd1a3d04af78ca87ca https://github.com/tianma-if/edgeever/issues/532 https://github.com/tianma-if/edgeever/issues/546 https://www.vulncheck.com/advisories/edgeever-desktop-1.92.0-through-1.112.0-local-program-execution-via-acp-ipc

Frequently Asked Questions

What is CVE-2026-109556? +

EdgeEver Desktop 1.92.0 through 1.112.0 contains a remote code execution vulnerability in the desktop:acp-probe IPC handler, which lacks a sender check and spawns a caller-supplied input.path executable. Attackers with script execution in a renderer, such as via template-preview or drag-preview stored cross-site scripting, can call probeAcpAdapter to launch local executables with the user's privileges. It has a CVSS v3.1 base score of 8.0 (HIGH).

How severe is CVE-2026-109556? +

CVE-2026-109556 has a CVSS v3.1 score of 8.0 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching. The EPSS score is 0.0065, placing it in the 1th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-109556? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-121145

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to insufficient validation of URLs and origins loaded …

CVE-2026-54702

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the webview message handler in …

CVE-2026-47899

The Electron preload script in Logseq exposes an API method that allows the renderer process to invoke IPC handlers without …

CVE-2026-96430

Exposed Dangerous Method or Function in the /WebAgenda/SQLWin.do API endpoint of Flowring Agentflow 4.0 version Before 2026/08/28 allows remote authenticated …

CVE-2026-92612

In Eclipse iceoryx2 versions greater than v0.8.0, the StaticString exposes its contents as mutable bytes through safe APIs, while String::as_str() …

CVE-2026-75810

Exposed Dangerous Method or Function in ASUS Armoury Crate allow a local user to cause a brief system stall by …