CVE-2026-68490

DiscoveredSep 23, 2026UpdatedSep 24, 2026

Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts.

CVSS v3.1

—

EPSS

0.14%

probability of exploitation in 30 days

CISA KEV

Not listed

no confirmed exploitation reported

News coverage

sources referencing this CVE

Related IOCs

seen in the same coverage

EPSS Trend

Sep 25, 2026 → Sep 30, 2026

● 0.00pp

0.13% → 0.14% over 2 tracked changes

Connections

3 relationships

Timeline

disclosure → media coverage

Sep 23, 2026

Disclosure — published as a CVE record.

Sep 25, 2026

dyn.cncs.gov.pt reports: Alerta de Vulnerabilidade - cPanel & WHM

Sep 28, 2026

thehackernews.com reports: ⚡ Weekly Recap: $387M Crypto Hack, Citrix Exploits, AI Agents Go Off-Script, and More Threats