Is CVE-2026-38945 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-38945 being exploited in the wild.

How severe is CVE-2026-38945?

Informational severity, with a CVSS score of 7.8, published 27 May 2026.

Which products and versions are affected?

Raynet RayVentory Scan Engine 12.6 Update 8 and earlier.

Is there a fix for CVE-2026-38945?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-38945 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2026-38945?

Check whether you run Raynet RayVentory Scan Engine at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-38945: Raynet RayVentory Scan Engine command injection in Java search

CVE-2026-38945 · Severity: info · CVSS 7.8 · Published 2026-05-27

A vulnerability in the Raynet RayVentory Scan Engine allows local users to execute unauthorized code with elevated privileges. The software, which is used for IT asset inventory and scanning, improperly searches for Java installations on the system. An attacker can create a specially named directory and file that the scanner will mistakenly execute, potentially leading to a full system compromise or unauthorized data access.

Technologies: Raynet RayVentory Scan Engine. Vendors: Raynet.

Quick answers

Is CVE-2026-38945 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-38945 being exploited in the wild.
How severe is CVE-2026-38945?: Informational severity, with a CVSS score of 7.8, published 27 May 2026.
Which products and versions are affected?: Raynet RayVentory Scan Engine 12.6 Update 8 and earlier.
Is there a fix for CVE-2026-38945?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-38945 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-38945?: Check whether you run Raynet RayVentory Scan Engine at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A command injection vulnerability exists in the Raynet rvia agent (RayVentory Scan Engine) version 12.6 Update 8 and prior. When the 'oracle' option is invoked without a pre-configured Java path, the agent executes a 'find' command to locate Java binaries. The search criteria for excluding world-writable directories like /tmp are improperly terminated (missing trailing wildcards), and the search patterns for Java binaries use leading wildcards. A local attacker can exploit this by creating a malicious executable at a path such as /tmp/jdk/bin/java. When the agent's Java detection process runs (often via a high-privileged cron job), it identifies and executes the attacker-controlled binary to check its version, resulting in arbitrary code execution with the privileges of the rvia agent.

Affected products

Raynet RayVentory Scan Engine (rvia) 12.6 Update 8 and earlier

Timeline

2026-05-27: disclosed: Vulnerability details and CVE published
2026-05-27: advisory: Raynet advisory RSEC200967 referenced

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.