# CVE-2026-82779: Contec CONPROSYS TM Series OS command injection

Source: https://junglewise.ai/threats/cve-2026-82779-contec-conprosys-tm-series-os-command-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-14. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-82779 · Severity: high · CVSS 8.8 · Published 2026-09-14

Contec CONPROSYS TM Series is an industrial automation controller used to manage factory equipment and processes. A vulnerability allows authenticated users to execute arbitrary operating system commands on the device, potentially disrupting critical manufacturing operations or enabling further compromise of the industrial network.

Vendors: [Contec](https://junglewise.ai/threats/vendors/contec).

## Quick answers

**Is CVE-2026-82779 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82779 being exploited in the wild.

**How severe is CVE-2026-82779?** High severity, with a CVSS score of 8.8, published 14 September 2026.

**Which products and versions are affected?** Contec CONPROSYS TM Series before 2.19.

**Is there a fix for CVE-2026-82779?** A patch was published on 2026-09-14: Fixed in firmware version 2.19 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-82779 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-82779?** Check whether you run Contec CONPROSYS TM Series at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An OS command injection vulnerability (CWE-78) exists in CONPROSYS TM Series due to improper neutralization of special elements in user input passed to OS commands. The vulnerability requires authentication to exploit; an attacker with valid login credentials can supply specially crafted input through the product's interface that will be executed as arbitrary OS commands. This allows complete compromise of the affected device including reading/modifying files, executing malicious code, and pivoting to other systems on the network. Patches are available in firmware version 2.19 for affected TM Series models.

## Affected products

- Contec CONPROSYS TM Series before 2.19

## Timeline

- 2026-09-14: disclosed: CVE-2026-82779 published
- 2026-09-14: patched: Fixed in firmware version 2.19

## References

- [https://jvn.jp/en/vu/JVNVU96551518/](https://jvn.jp/en/vu/JVNVU96551518/)
- [https://www.contec.com/api/downloadlogger?download=/-/media/Contec/support/security-info/2026/contec_security_cps_26091000_en.pdf](https://www.contec.com/api/downloadlogger?download=/-/media/Contec/support/security-info/2026/contec_security_cps_26091000_en.pdf)

## Related threats

- [Contec CONPROSYS TM Series unrestricted file upload](https://junglewise.ai/threats/cve-2026-82780-contec-conprosys-tm-series-unrestricted-file-upload)