CVE-2026-85979

Command Injection in Puppet Enterprise

State: Published
Severity: 8.6 High
Published: Sep 11, 2026
Updated: Sep 16, 2026
Reserved: Sep 4, 2026

Description

Affected versions of Puppet Enterprise contain a command injection vulnerability. An authenticated user with Puppet administrative privileges can inject arbitrary shell commands by providing a specially crafted value for this parameter, which is passed to a shell execution context without sufficient sanitization. Because the resulting commands are executed with root privileges, successful exploitation can lead to full compromise of the affected system.

It affects Puppet Enterprise 2023.8.0 through 2023.8.10 and Puppet Enterprise 2025.0.0 through 2025.11.2.

This has been resolved in Puppet Enterprise 2023.8.11 and Puppet Enterprise 2025.11.3.

Scores

CVSS	Score	Vector	Source
4.0	8.6 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	Perforce

Weaknesses

CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')
CWE-20 Improper input validation
CWE-269 Improper Privilege Management

Affected Products

Product	Versions
Puppet EnterprisePerforce Software	2023.8.0 through 2023.8.10Affected 2025.0.0 through 2025.11.2Affected 2023.8.11Not affected 2025.11.3Not affected

References

https://portal.perforce.com/s/cve/a91Qi000003CybNIAS/command-injection-in-puppet-enterprisevendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.