CVE-2026-49922

Summary

A confused deputy vulnerability in ConnectionServiceWrapper.java allows a local unprivileged process to bypass permission checks and access remote connection services it should not be authorized to use, leading to full local privilege escalation without user interaction.

Exploitability

Exploitation is straightforward for a local attacker with no additional privileges or user interaction required, as the flaw resides in internal service handling logic.

Blast radius

Successful exploitation grants an attacker full local system compromise (confidentiality, integrity, and availability) via unauthorized access to sensitive remote connection services.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Apply the vendor patch for CVE-2026-49922 when released; until then, restrict access to ConnectionServiceWrapper functionality by disabling or isolating the affected interface per vendor guidance. No fixed version is published in the provided description.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.