HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-82017 — IGEL OS 12 before 12.7.6 and IGEL OS 11 before 11.11.150 contain a boot registry...

·Source: NIST NVD

Updated:

Executive Summary

IGEL OS 12 before 12.7.6 and IGEL OS 11 before 11.11.150 contain a boot registry parameter injection vulnerability that allows attackers with physical access to execute arbitrary Linux loader parameters by writing to an unencrypted and unsigned configuration area read by the signed bootloader. Attackers can inject malicious kernel command line parameters that execute with boot environment privileg

Analysis

IGEL OS 12 before 12.7.6 and IGEL OS 11 before 11.11.150 contain a boot registry parameter injection vulnerability that allows attackers with physical access to execute arbitrary Linux loader parameters by writing to an unencrypted and unsigned configuration area read by the signed bootloader. Attackers can inject malicious kernel command line parameters that execute with boot environment privileges without triggering TPM PCR measurement failures, as the attack does not modify the measured boot code. CVSS Score: 7.6. Published: 2026-08-28T22:16:55.067.

Indicators of Compromise (1)

CVE (1)
CVE-2026-82017
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Aug 28, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

Unit 42 Sees AI Rewriting Enterprise Security Work

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/unit-42-sees-ai-rewriting-enterprise-security-work-image_small-4-a-32691.jpg" align=right hspace=4><b>Unit 42 Says Human Experts Will Increasingly Oversee AI-Driven Defense Work</b><br>The job of security professionals will shift more toward administration and orchestration as security moves to more autonomous agents, Palo Alto Ne

Bank Info Security
MEDIUMVulnerability

McKesson discloses breach after ShinyHunters claims patient data theft

Healthcare and pharmaceutical distribution giant McKesson has disclosed a cybersecurity incident involving unauthorized access to third-party applications and data theft, with the ShinyHunters extortion group claiming it stole 284 million patient data records. [...]

BleepingComputer
CRITICALVulnerability

NVD CRITICAL: CVE-2026-3627 — IBM Concert 1.0.0 through 2.3.1 is vulnerable to SQL injection. A remote attacke...

IBM Concert 1.0.0 through 2.3.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.

CVE-2026-3627
NIST NVD