Critical Actively exploited
CVE-2026-49869
Kestra OSS OS Command Injection Vulnerability
What this means
- Weakness
- Unfiltered input reaches the system shell, letting the attacker run their own commands on the server.
- Likelihood
- Exploitation is not hypothetical: CISA has observed it in the wild.
What to doTop priority: CISA sets the remediation deadline at 5 September 2026.
Read automatically from the CVSS vector, the weakness type (CWE) and the EPSS score. The technical description above remains the one published by NIST.