High severity · published Feb 17, 2026
CVE-2026-23648
Glory RBG-100 Recycler System Local Privilege Escalation via Insecure File Permissions
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
Glory RBG-100 recycler systems using the ISPK-08 software component contain multiple system binaries with overly permissive file permissions. Several binaries executed by the root user are writable and executable by unprivileged local users. An attacker with local access can replace or modify these binaries to execute arbitrary commands with root privileges, enabling local privilege escalation.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 5% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RB
RBG-100 · Glory Global Solutions
0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-23648
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-23648
www.glory-global.com
https://www.glory-global.com/
www.vulncheck.com
https://www.vulncheck.com/advisories/glory-rbg-100-recycler-system-local-privilege-escalation-via-insecure-file-permissions
More from RBG-100
9.8
CVE-2026-23647
Glory RBG-100 Recycler System Hard-coded OS Credentials
