# CVE-2026-82794: Contec SolarView Compact OS command injection in Schedule Settings

Source: https://junglewise.ai/threats/cve-2026-82794-contec-solarview-compact-os-command-injection-in-schedule  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-14. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-82794 · Severity: high · CVSS 8.8 · Published 2026-09-14

SolarView Compact is an industrial monitoring and control system used by organizations to manage solar power installations and related equipment. An OS command injection vulnerability in the Schedule Settings component allows authenticated attackers to execute arbitrary system commands on the device, potentially leading to full system compromise, data theft, or disruption of power generation monitoring and control operations.

Vendors: [Contec](https://junglewise.ai/threats/vendors/contec).

## Quick answers

**Is CVE-2026-82794 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82794 being exploited in the wild.

**How severe is CVE-2026-82794?** High severity, with a CVSS score of 8.8, published 14 September 2026.

**Which products and versions are affected?** Contec SolarView Compact SV-CPT-MC310 prior to 9.00; Contec SolarView Compact SV-CPT-MC310F prior to 9.00.

**Is there a fix for CVE-2026-82794?** A patch was published on 2026-09-10: Firmware version 9.00 or later available Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-82794 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-82794?** Check whether you run Contec SolarView Compact SV-CPT-MC310 or Contec SolarView Compact SV-CPT-MC310F at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

SolarView Compact contains an OS command injection vulnerability (CWE-78) in the Schedule Settings feature. The vulnerability requires authenticated access (login credentials) but does not require user interaction. An attacker with valid login credentials can inject arbitrary OS commands that will be executed with the privileges of the application, allowing arbitrary code execution on the underlying system. The CVSS 3.1 score of 8.8 reflects high impact on confidentiality, integrity, and availability. A firmware patch to version 9.00 or later is available from the vendor.

## Affected products

- Contec SolarView Compact SV-CPT-MC310 prior to 9.00
- Contec SolarView Compact SV-CPT-MC310F prior to 9.00

## Timeline

- 2026-09-10: disclosed
- 2026-09-10: patched: Firmware version 9.00 or later available

## References

- [https://jvn.jp/en/vu/JVNVU97753461/](https://jvn.jp/en/vu/JVNVU97753461/)
- [https://www.contec.com/api/downloadlogger?download=/-/media/Contec/support/security-info/2026/contec_security_sv_26091000_en.pdf](https://www.contec.com/api/downloadlogger?download=/-/media/Contec/support/security-info/2026/contec_security_sv_26091000_en.pdf)

## Related threats

- [Contec SolarView Compact cross-site scripting in Image Management](https://junglewise.ai/threats/cve-2026-82796-contec-solarview-compact-cross-site-scripting-in-image-management)