PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-38945 Raynet CVE debrief

A command injection vulnerability in Raynet rvia version 12.6 Update 8 and earlier allows local attackers to execute arbitrary code. The flaw stems from improper input sanitization in rvia's Java search functionality, which uses the find command with improperly terminated search criteria. An attacker can exploit this by crafting a malicious path that injects commands into the find operation. The vulnerability requires local access and low privileges but enables high-impact outcomes including full confidentiality, integrity, and availability compromise.

Vendor
Raynet
Product
rvia
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-01
Advisory published
2026-05-27
Advisory updated
2026-06-01

Who should care

Organizations running Raynet rvia version 12.6 Update 8 or earlier in production environments. System administrators responsible for Java-based search infrastructure. Security teams monitoring for command injection vulnerabilities in enterprise applications. Organizations with multi-user systems where rvia is accessible to non-administrative users.

Technical summary

The vulnerability exists in rvia's Java search implementation which utilizes the find command. The search criteria are improperly terminated, allowing an attacker to inject additional commands through a specially crafted file path. When rvia processes this path during its search operation, the injected commands execute with the privileges of the rvia process. This represents a classic command injection pattern (CWE-77) where unsanitized input is passed to a shell command. The local attack vector and requirement for low privileges suggests this could be chained with other vulnerabilities or used for privilege escalation on multi-user systems where rvia is deployed.

Defensive priority

HIGH

Recommended defensive actions

  • Review and update rvia installations to a patched version when available from Raynet
  • Audit systems for rvia version 12.6 Update 8 or earlier installations
  • Restrict local access to rvia installations to authorized administrators only
  • Monitor for suspicious find command executions or unexpected Java process behavior
  • Contact Raynet support for patch availability and remediation guidance
  • Review application logs for evidence of path manipulation attempts

Evidence notes

The CVE description identifies Raynet rvia version 12.6 Update 8 and previous versions as affected. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms local attack vector with low attack complexity and low privileges required. CWE-77 (Command Injection) is cited as the weakness type. The vulnerability involves rvia's Java search using the find command with improperly terminated search criteria, allowing crafted path injection.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-38945 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-38945

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-38945 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-38945

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.