Is CVE-2026-89176 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-89176 being exploited in the wild.

How severe is CVE-2026-89176?

High severity, with a CVSS score of 8.8, published 11 September 2026.

Which products and versions are affected?

Howyar Technologies WeenyGenius 12.2.031 and earlier.

Is there a fix for CVE-2026-89176?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-89176 attacked?

It is attacked from the adjacent network or over the network.

Am I affected by CVE-2026-89176?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-89176: Howyar WeenyGenius missing authentication in endpoint communication

CVE-2026-89176 · Severity: high · CVSS 8.8 · Published 2026-09-11

WeenyGenius is a computer lab management system used by educational institutions to control and monitor student computers in classroom environments. CVE-2026-89176 allows unauthenticated attackers on the same network to impersonate students or teachers without any login credentials, enabling them to disrupt classes, take remote control of student systems, or manipulate classroom operations. This affects organizations running version 12.2.031 or earlier.

Quick answers

Is CVE-2026-89176 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-89176 being exploited in the wild.
How severe is CVE-2026-89176?: High severity, with a CVSS score of 8.8, published 11 September 2026.
Which products and versions are affected?: Howyar Technologies WeenyGenius 12.2.031 and earlier.
Is there a fix for CVE-2026-89176?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-89176 attacked?: It is attacked from the adjacent network or over the network.
Am I affected by CVE-2026-89176?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

CVE-2026-89176 is a missing authentication vulnerability in WeenyGenius that allows unauthenticated attackers on the same network to spoof student or teacher endpoints. The system lacks proper identity verification mechanisms for endpoint communication, enabling attackers to send network packets with forged identities. An attacker can impersonate a teacher workstation to send commands that cause student computers to establish connections to attacker-controlled systems, effectively granting remote control. Impersonating a student endpoint can disrupt classroom operations and learning management. The vulnerability requires network adjacency (same network segment) but no credentials or user interaction. A patch is available in version 12.3.033 and later.

Affected products

Howyar Technologies WeenyGenius 12.2.031 and earlier

Timeline

2026-09-11: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.