Is CVE-2026-46606 actively exploited?

No active exploitation of CVE-2026-46606 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-46606 be exploited remotely?

No. CVE-2026-46606 requires local access to exploit.

What is the CVSS score of CVE-2026-46606?

CVE-2026-46606 has a CVSS score of 7.8 (HIGH).

HOME VULNERABILITIESCVE-2026-46606

HIGH

CVE-2026-46606

CWE-78Published: June 25, 2026· Updated: Jun 25, 2026

7.8

CVSS v3.1

EPSS:0.21%probability of exploitation in 30 daysPercentile:11.6th

Official Description

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances KVM/QEMU monitoring engine (glances/plugins/vms/engines/virsh.py) passes VM domain names, read directly from virsh list --all output, into f-string command templates that are processed by secure_popen(). secure_popen() is explicitly designed to interpret &&, |, and > as shell operators. Because domain names are never sanitised before interpolation, any user with the ability to create or rename a KVM/QEMU virtual machine can execute arbitrary commands as the OS user running Glances — commonly root on hypervisor hosts. This vulnerability is fixed in 4.5.5.

NVD Source

Technical Analysis

CVE-2026-46606 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 7.8.