Is CVE-2026-97401 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-97401 being exploited in the wild.

How severe is CVE-2026-97401?

Informational severity, published 10 November 2026.

Which products and versions are affected?

Eclipse Kura 0.7.0 through 5.6.2.

Is there a fix for CVE-2026-97401?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-97401 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-97401?

Check whether you run Eclipse Kura at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-97401: Eclipse Kura privilege escalation in CommandCloudApp ZIP extraction

CVE-2026-97401 · Severity: info · Published 2026-11-10

Eclipse Kura is an open-source IoT edge computing platform that runs on gateways and edge devices. A flaw in the CommandCloudApp component allows an authenticated user with restricted unprivileged command permissions to extract arbitrary files onto the device with elevated privileges by controlling the working directory and ZIP contents, bypassing the security sandbox intended to restrict their access.

Technologies: Eclipse Kura. Vendors: Eclipse.

Quick answers

Is CVE-2026-97401 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-97401 being exploited in the wild.
How severe is CVE-2026-97401?: Informational severity, published 10 November 2026.
Which products and versions are affected?: Eclipse Kura 0.7.0 through 5.6.2.
Is there a fix for CVE-2026-97401?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-97401 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-97401?: Check whether you run Eclipse Kura at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The CommandCloudApp.execute() method extracts a caller-supplied ZIP archive into a caller-supplied directory before dispatching commands to an executor service. On packaged Kura installations, the JVM process runs as `kurad` with CAP_DAC_OVERRIDE capability, while the unprivileged executor is intended to drop to the `kura` user via `su`. An attacker with `rest.command` permissions and unprivileged command execution enabled (the default) can set `workingDirectory` to `/` to extract files at the filesystem root with kurad privileges, bypassing the privilege boundary. The vulnerability does not affect systems where the command service is disabled (default since Kura 4.0.0).

Affected products

Eclipse Kura 0.7.0 through 5.6.2

Timeline

2026-11-10: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.