Description
Affected versions of Puppet Enterprise contain a command injection vulnerability. An authenticated user with Puppet administrative privileges can inject arbitrary shell commands by providing a specially crafted value for this parameter, which is passed to a shell execution context without sufficient sanitization. Because the resulting commands are executed with root privileges, successful exploitation can lead to full compromise of the affected system. 

It affects Puppet Enterprise 2023.8.0 through 2023.8.10 and Puppet Enterprise 2025.0.0 through 2025.11.2.



This has been resolved in Puppet Enterprise 2023.8.11 and Puppet Enterprise 2025.11.3.
Published: 2026-09-11
Score: 8.6 High
EPSS: 1.3% Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

An authenticated Puppet administrator can inject arbitrary shell commands by providing a specially crafted value for an internal parameter. That value is passed directly to a shell execution context without sufficient sanitization, enabling execution of arbitrary commands. Because the commands run with root privileges, exploitation can lead to full compromise of the affected system, affecting confidentiality, integrity, and availability.

Affected Systems

Perforce Software’s Puppet Enterprise platform is impacted. Vulnerable versions include Puppet Enterprise 2023.8.0 through 2023.8.10 and Puppet Enterprise 2025.0.0 through 2025.11.2. Any deployment running these versions should verify the installed version and upgrade promptly.

Risk and Exploitability

The CVSS score of 8.6 indicates a high severity. The EPSS score is less than 1%, and the vulnerability is not listed in CISA KEV. The attack vector is local: the attacker must be authenticated with Puppet administrative privileges, but once achieved the ability to execute arbitrary commands as root presents a full compromise potential.

Generated by OpenCVE AI on September 21, 2026 at 04:22 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the official patch or upgrade to the latest Puppet Enterprise version that resolves the command injection flaw.
  • Restrict administrative access to Puppet Enterprise, ensuring only trusted users have Puppet admin rights.
  • Review the Puppet Enterprise configuration files for any parameters that are passed unsanitized to shell execution contexts, enforce strict input validation, or disable unnecessary interfaces if possible.

Generated by OpenCVE AI on September 21, 2026 at 04:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 16 Sep 2026 10:00:00 +0000

Type Values Removed Values Added
Description Affected versions of Puppet Enterprise contain a command injection vulnerability in the handling of the java_keystore_passwd parameter. An authenticated user with Puppet administrative privileges can inject arbitrary shell commands by providing a specially crafted value for this parameter, which is passed to a shell execution context without sufficient sanitization. Because the resulting commands are executed with root privileges, successful exploitation can lead to full compromise of the affected system. Affected versions of Puppet Enterprise contain a command injection vulnerability. An authenticated user with Puppet administrative privileges can inject arbitrary shell commands by providing a specially crafted value for this parameter, which is passed to a shell execution context without sufficient sanitization. Because the resulting commands are executed with root privileges, successful exploitation can lead to full compromise of the affected system.  It affects Puppet Enterprise 2023.8.0 through 2023.8.10 and Puppet Enterprise 2025.0.0 through 2025.11.2. This has been resolved in Puppet Enterprise 2023.8.11 and Puppet Enterprise 2025.11.3.

Sun, 13 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Perforce Software
Perforce Software puppet Enterprise
Vendors & Products Perforce Software
Perforce Software puppet Enterprise

Fri, 11 Sep 2026 23:45:00 +0000

Type Values Removed Values Added
Title Command Injection in Puppet Enterprise

Fri, 11 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 11 Sep 2026 14:45:00 +0000

Type Values Removed Values Added
Description Affected versions of Puppet Enterprise contain a command injection vulnerability in the handling of the java_keystore_passwd parameter. An authenticated user with Puppet administrative privileges can inject arbitrary shell commands by providing a specially crafted value for this parameter, which is passed to a shell execution context without sufficient sanitization. Because the resulting commands are executed with root privileges, successful exploitation can lead to full compromise of the affected system.
Weaknesses CWE-20
CWE-269
CWE-78
References
Metrics cvssV4_0

{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Perforce Software Puppet Enterprise
cve-icon MITRE

Status: PUBLISHED

Assigner: Perforce

Published:

Updated: 2026-09-16T09:49:14.319Z

Reserved: 2026-09-04T18:45:39.755Z

Link: CVE-2026-85979

cve-icon Vulnrichment

Updated: 2026-09-11T15:00:46.660Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-11T15:17:06.807

Modified: 2026-09-18T19:30:42.730

Link: CVE-2026-85979

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-21T04:30:08Z

Weaknesses
  • CWE-20

    Improper Input Validation

  • CWE-269

    Improper Privilege Management

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')