HIGHVulnerability
Verified
Global

CISA KEV: Kestra Kestra OSS — Kestra OSS OS Command Injection Vulnerability

·Source: CISA KEV

Updated:

Executive Summary

Kestra OSS contains an OS command injection vulnerability that could allow an unauthenticated remote attacker to create and execute arbitrary workflows without credentials.

Analysis

Kestra OSS contains an OS command injection vulnerability that could allow an unauthenticated remote attacker to create and execute arbitrary workflows without credentials. Added to CISA Known Exploited Vulnerabilities catalog on 2026-09-02. Remediation due: 2026-09-05.

Indicators of Compromise (1)

CVE (1)
CVE-2026-49869
NVDMITRE CVE
Source Attribution

Originally published by CISA KEV on Sep 2, 2026. Verified by: CISA.

Related Threats

MEDIUMVulnerabilityNEW

UAE, Saudi Arabia Face Onslaught of Increasingly Complex Cyberattacks

The United Arab Emirates and Kingdom of Saudi Arabia together absorbed 50% of all cyberattacks recorded across the Gulf region in the first half of 2026.

Dark Reading
CRITICALVulnerability

Adobe Patches Critical Flaws in Connect, AEM Forms

The nine critical security defects could be exploited for arbitrary code execution and privilege escalation. The post Adobe Patches Critical Flaws in Connect, AEM Forms appeared first on SecurityWeek .

SecurityWeek
MEDIUMVulnerability

Microsoft: September Windows updates break Always On VPN connections

Microsoft warned that the September 2026 security updates may also break Always On VPN connections on some Windows 11 systems. [...]

BleepingComputer