CVE-2026-46695
📛 CVE Title
(no title)
Description
BoxLite: Permission Bypass Allows Modification of Read-Only Files
Description (MITRE) cveawg.mitre.org
Pulled from cveawg.mitre.org/api/cve/CVE-2026-46695 on 2026-07-28. Shown when MITRE's text differs from the cvelistV5 mirror.
Boxlite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and launch OCI containers within them to run untrusted code. Prior to version 0.9.0, Boxlite does not restrict the kernel capabilities available inside the container, malicious code can remount the directory in rw mode, thereby gaining write access to that directory. This allows malicious code to perform arbitrary write operations on directories that should be read-only. This issue has been patched in version 0.9.0.
Overview
- State
- —
- Assigner (CNA)
- —
- CVSS severity
- critical
- CVSS score
- 9.4 / 10
- CVSS vector
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N- Effective score
- 9.4 / 10 CRITICAL source: CNA overview
- CWE(s)
- —
- Reserved
- —
- Published
- —
- Last updated
- —
- Source
- https://www.tenable.com/cve/CVE-2026-46695
- Linked Threat
- CVE-2026-46695 — CVE-2026-46695
NVD / KEV / EPSS data refreshed 2026-05-25 00:14 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2026-36166 - Assigner
- GitHub_M
- Published
- Jun 10, 2026, 10:20:44 PM
- Updated
- Jun 11, 2026, 12:38:03 PM
- EUVD base score (CVSS 3.1)
-
10.0 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N - EUVD-reported EPSS
- 0.2900
- Vendors
- boxlite-ai
- Products
-
boxlite (< 0.9.0)
- Aliases
-
GHSA-g6ww-w5j2-r7x3
ENISA description: Boxlite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and launch OCI containers within them to run untrusted code. Prior to version 0.9.0, Boxlite does not restrict the kernel capabilities available inside the container, malicious code can remount the directory in rw mode, thereby gaining write access to that directory. This allows malicious code to perform arbitrary write operations on directories that should be read-only. This issue has been patched in version 0.9.0.
Vendor references (0)
References embedded in the original CVE record by the assigning CNA.
None in the CVE record.
MITRE references (3) cveawg.mitre.org
Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.
- https://github.com/boxlite-ai/boxlite/pull/454 x_refsource_MISC
- https://github.com/boxlite-ai/boxlite/releases/tag/v0.9.0 x_refsource_MISC
- https://github.com/boxlite-ai/boxlite/security/advisories/GHSA-g6ww-w5j2-r7x3 x_refsource_CONFIRM
Web references (2)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
- https://nvd.nist.gov/vuln/detail/CVE-2026-46695 tenable:nvd.nist.gov
- https://www.cve.org/CVERecord?id=CVE-2026-46695 tenable:www.cve.org
Remediations (10)
Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.
-
web:blog.talosintelligence.com
Microsoft has released its monthly security update for May 2026 , which includes 137 vulnerabilities affecting a range of products, including 16 that Microsoft marked as "critical".
2026-05-26 02:59 UTC -
web:cyberscoop.com
Threats Microsoft addresses 137 vulnerabilities in May's Patch Tuesday, including 13 rated critical The high volume of vulnerabilities reflects a growing trend researchers have been anticipating as artificial intelligence models are deployed to find previously uncovered defects in code.
2026-05-26 02:59 UTC -
web:cybersecuritynews.com
No patch has been released yet; Microsoft has instead issued a multi-step manual mitigation guide while a formal security update is prepared. Windows BitLocker Security Bypass The vulnerability originates in WinRE's handling of the BootExecute registry value under HKLM\ControlSet001\Control\Session Manager.
2026-05-26 02:59 UTC -
web:learn.microsoft.com
Learning path Learn how Microsoft supports secure software development as part of a cybersecurity solution - Training Secure software development means integrating security into each phase of your development lifecycle, from requirements analysis to maintenance. Microsoft provides many services that can help you develop more secure code and deploy a more secure application in the cloud. This ...
2026-05-26 02:59 UTC -
web:msrc.microsoft.com
The Microsoft Security Response Center (MSRC) investigates all reports of security vulnerabilities affecting Microsoft products and services, and provides the information here as part of the ongoing effort to help you manage security risks and help keep your systems protected.
2026-05-26 02:59 UTC -
web:thehackernews.com
Microsoft's January 2026 Patch Tuesday fixes 114 Windows flaws, including an actively exploited Desktop Window Manager bug added to CISA's KEV list.
2026-05-26 02:59 UTC -
web:windowsreport.com
The newly exposed Windows security flaw, dubbed "YellowKey," has become a major headache for Microsoft. After the exploit details leaked publicly alongside a working proof-of-concept, the company has now rushed out official mitigation guidance while it prepares a permanent fix . The vulnerability reportedly targets BitLocker-protected systems and could allow attackers direct access to ...
2026-05-26 02:59 UTC -
web:www.bleepingcomputer.com
Today is Microsoft's April 2026 Patch Tuesday with security updates for 167 flaws, including 2 zero-day vulnerabilities.
2026-05-26 02:59 UTC -
web:www.crowdstrike.com
Microsoft's April 2026 Patch Tuesday addresses 164 CVEs , featuring 8 Critical vulnerabilities, one exploited zero-day, and one disclosed zero-day.
2026-05-26 02:59 UTC -
web:zecurit.com
Get the complete breakdown of Microsoft's May 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .
2026-05-26 02:59 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.