CVE-2026-89040: Tencent Mass Service Engine In Cluster Msec

Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days.

Tencent Mass Service Engine in Cluster (MSEC) allows a remote, unauthenticated attacker to send a crafted POST request including ../ and gain root access on the target device. An attacker who uploads a webshell can execute arbitrary code as root.

Affected products

• Tencent Mass Service Engine In Cluster Msec: any version

Published 2026-09-15. Last modified 2026-09-22.