# CVE-2026-89040: Tencent MSEC path traversal to remote code execution

Source: https://junglewise.ai/threats/cve-2026-89040-tencent-msec-path-traversal-to-remote-code-execution  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-89040 · Severity: critical · CVSS 9.8 · Published 2026-09-15

Tencent's MSEC is a backend service platform used for managing microservices, load balancing, and infrastructure operations. A critical flaw allows unauthenticated attackers to bypass access controls using path traversal (../ sequences) in POST requests, gain root-level access, and execute arbitrary code by uploading malicious scripts. This poses an immediate risk to any production system running MSEC, enabling complete compromise of backend infrastructure and data.

Vendors: [Tencent](https://junglewise.ai/threats/vendors/tencent).

## Quick answers

**Is CVE-2026-89040 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-89040 being exploited in the wild.

**How severe is CVE-2026-89040?** Critical severity, with a CVSS score of 9.8, published 15 September 2026.

**Which products and versions are affected?** Tencent Mass Service Engine in Cluster (MSEC) all versions.

**Is there a fix for CVE-2026-89040?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-89040 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-89040?** Check whether you run Tencent Mass Service Engine in Cluster (MSEC) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a path traversal (CWE-22) flaw in MSEC's request handling. An unauthenticated attacker can craft a POST request containing ../ sequences to escape directory restrictions and access protected resources or upload files with elevated privileges. No authentication is required and the attack is trivial to execute over the network. An attacker can upload a webshell and execute code as root, achieving complete system compromise. No fix is available; the repository was archived by Tencent in October 2019 and remains unfixed.

## Affected products

- Tencent Mass Service Engine in Cluster (MSEC) all versions

## Timeline

- 2026-09-15: disclosed
- other: Repository archived October 2019, no fix planned

## References

- [https://github.com/Tencent/MSEC](https://github.com/Tencent/MSEC)
- [https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-258-02.json](https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-258-02.json)