Secuno
ENNL
Book demo

CVE-2026-68928

8.6 HIGH
  1. Published18 Sept 2026

Description

Acode is a powerful text and code editor for Android. From 1.11.6 until 1.12.7, com.foxdebug.acode.rk.exec.terminal.TerminalService is declared as an exported service in src/plugins/terminal/plugin.xml without a binding permission, and src/plugins/terminal/src/android/TerminalService.java does not verify the caller. Any installed Android application can bind the service and send MSG_EXEC with an attacker-controlled cmd value, which the terminal implementation passes to ProcessBuilder with sh -c inside Acode's UID. This allows a zero-permission local application to execute commands with access to Acode private data, remote credentials, Storage Access Framework grants, and runtime permissions without additional interaction at attack time. This issue is fixed in version 1.12.7.

CVSS 3.1 breakdown

Attack vectorLocal
Attack complexityLow
Privileges requiredNone
User interactionRequired
ScopeChanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-828858.8
IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to gain…
CVE-2026-618218.5
pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID.…
CVE-2026-615509.8
Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and…
CVE-2026-854108.1
The Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup…
CVE-2026-894138.1
The Filter Gallery plugin for WordPress is vulnerable to authorization bypass in all…
CVE-2026-546718.8
WeGIA is a web manager for charitable institutions. Prior to 3.8.5, WeGIA maps…

Frequently asked

Is CVE-2026-68928 being actively exploited?

CVE-2026-68928 is not in the CISA KEV catalog.

How severe is CVE-2026-68928?

CVE-2026-68928 has a CVSS 3.1 base score of 8.6, rated high.

How do I fix CVE-2026-68928?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-68928 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.