CVE-2026-90999 Functional Software, Inc. CVE debrief

Who should care

Defenders and security teams responsible for Sentry Seer installations and automation environments should assess exposure and prioritize remediation. The vulnerability has a CVSS score of 9.8 and is considered critical. Security teams should review and update Sentry Seer configurations to prevent unauthenticated telemetry submission and implement additional security measures to monitor and restrict telemetry data.

Why it matters

CVE-2026-90999 is a critical vulnerability in Sentry Seer that allows unauthenticated attackers to submit fabricated telemetry, which can be executed as code in a privileged automation environment. Defenders and security teams responsible for Sentry Seer installations and automation environments should assess exposure and prioritize remediation.

• Potential code execution in privileged automation environments
• Unauthenticated telemetry submission and execution
• Critical CVSS score of 9.8 indicating high severity

Technical summary

The vulnerability is a multi-stage trust-boundary violation that allows unauthenticated attacker-controlled telemetry to become code executed by an agent in a privileged automation environment. This vulnerability has a CVSS score of 9.8 and is considered critical. The vulnerability allows unauthenticated attackers to submit fabricated telemetry, which can be executed as code in a privileged automation environment. The affected product is Sentry Seer, and defenders and security teams should assess exposure and prioritize remediation.

Defensive priority

High

Recommended defensive actions

• Review and update Sentry Seer configurations to prevent unauthenticated telemetry submission
• Implement additional security measures to monitor and restrict telemetry data
• Verify and apply any available patches or updates for Sentry Seer
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD vulnerability detail page provide information about the vulnerability, including its description, CVSS score, and references. The vulnerability has a CVSS score of 9.8 and is considered critical. There is limited information available about the affected products and versions. Defenders and security teams should verify the affected scope and apply available patches or updates.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.