The vulnerability is an improper privilege management flaw in the command shell of Wind River VxWorks 7. When the system is configured to enforce per‑user command privileges, specific shell operations can bypass the normal privilege check, enabling an authenticated user with limited rights to run commands they are not authorized for. Successful exploitation results in privilege escalation, compromising the confidentiality, integrity and availability of the device. This issue affects all VxWorks 7 releases before 26.09 and has been fixed in version 26.09. The weakness is classified as CWE‑269.

Wind River VxWorks 7 versions prior to 26.09 when per‑user command privileges are enabled. The affected vendor is Wind River Systems Inc. The vendor has fixed the issue in version 26.09.

The CVSS score of 8.8 indicates high severity. Because exploitation requires an authenticated user to perform shell operations, the attack vector is likely local or within a trusted network segment. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, so the current exploitation probability is unclear. Nevertheless, the high severity and the nature of the flaw mean that administrators should treat this as a high‑priority risk.