CVE-2026-7852: Dangerous File Upload in LimRAD NAC
Critical CVSS (9.8) reachable over network.
| Field | Value |
|---|---|
| CVE ID | CVE-2026-7852 |
| CVSS score | 9.8 |
| Attack vector | Unknown from available source data; NVD states impact is Remote Code Inclusion |
| Auth required | Unknown from available source data |
| Patch status | Upgrade to 5.5.7.3.9 or later |
TL;DR - Critical LimRAD NAC flaw allows dangerous file upload leading to Remote Code Inclusion. - Affects LimRAD NAC versions before 5.5.7.3.9; upgrade to 5.5.7.3.9 or later. - No confirmed in-the-wild exploitation or public PoC is known from available sources, but defenders should treat exposure as urgent.
What happened and why it matters
CVE-2026-7852 is a critical vulnerability in Limatek System Inc. LimRAD NAC. The NVD describes it as an “unrestricted upload of file with dangerous type” vulnerability that “allows Remote Code Inclusion.” The affected range is clearly stated as “LimRAD NAC: before 5.5.7.3.9.” Based on that wording, defenders should treat all versions earlier than 5.5.7.3.9 as vulnerable and 5.5.7.3.9 or later as the current fixed target.
This matters because the affected product is a network access control (NAC) platform. NAC systems often sit in sensitive parts of the environment, integrate with identity and policy systems, and may have broad visibility into endpoint and network state. A dangerous file upload bug in such a product can turn into a high-impact foothold, especially if the management interface is exposed to broad internal networks, partner links, or the public internet.
The public record does not currently establish the exact vulnerable endpoint, whether authentication is required, the specific dangerous file types, or the exact execution path after upload. That uncertainty should not reduce urgency. In practice, when a critical upload flaw affects an internet-facing or privileged management application, defenders should assume a realistic path to server-side code execution until proven otherwise by vendor guidance or internal testing.
Exploitation status and risk assessment
As of 2026-06-11, exploitation in the wild is not confirmed from the available sources. Specifically, CISA KEV does not list CVE-2026-7852 at this time. That means there is no current CISA-backed confirmation of known exploitation. It does not mean exploitation is impossible or unlikely.
Also, no verifiable public PoC is known from the available research inputs. No public GitHub proof of concept, issue discussion, or exploit repository was identified in the source material provided. Again, defenders should interpret that cautiously: lack of a public PoC often means only that public exploit material has not surfaced yet, not that the bug is hard to weaponize.
Risk-wise, the combination of a critical 9.8 CVSS score, a dangerous file upload weakness, and an impact described as Remote Code Inclusion is enough to justify emergency change handling for exposed systems. If your LimRAD NAC instance is reachable from untrusted networks, prioritize patching and containment. If it is internal-only, still move quickly, because lateral movement scenarios often begin with compromised user or admin workstations that can reach management applications.
What defenders should do right now
Start by identifying every LimRAD NAC deployment in your environment and verifying whether each system is running a version before 5.5.7.3.9. Do not assume a single deployment model. Check physical appliances, virtual appliances, DR instances, lab copies, and secondary management nodes. If external parties manage the platform, require written confirmation of version and remediation timeline.
Next, review exposure. Determine whether the LimRAD NAC web interface or application services are accessible from the public internet, partner VPNs, contractor segments, or broad internal user VLANs. If the answer is yes, reduce access immediately while planning the upgrade. Restrict management reachability to a dedicated admin subnet or VPN group where possible.
Finally, perform a compromise assessment on any vulnerable instance that was internet-exposed or broadly reachable. Because the exact endpoint and exploit chain are not publicly documented in the source material, use a broad review approach: unusual uploads, new executable files, suspicious web requests, unexplained child processes, and outbound connections from the NAC host should all be treated as potential indicators.
Technical Notes
A practical first pass is to inventory likely web-facing listeners and recent changes on the host:
# Identify listening services
ss -tulpn
netstat -tulpn
# Find recently modified files under common web roots
find /var/www -type f -mtime -14 2>/dev/null
find /opt -type f -mtime -14 2>/dev/null | head -200
# Look for suspicious script-like extensions often associated with web shells
find / -type f \( -name "*.jsp" -o -name "*.jspx" -o -name "*.php" -o -name "*.asp" -o -name "*.aspx" -o -name "*.war" \) 2>/dev/null
If the appliance sits behind a reverse proxy or WAF, immediately pull logs covering large or anomalous multipart uploads:
# Nginx examples
grep -E 'POST .*HTTP/1\.[01]" (200|201|202|500)' /var/log/nginx/access.log | grep -i 'multipart/form-data'
# Apache examples
grep -E 'POST .* (200|201|202|500) ' /var/log/apache2/access.log | grep -i 'multipart/form-data'
Technical interpretation of the flaw
The vulnerability class, unrestricted upload of file with dangerous type, usually points to weak server-side validation. Common implementation mistakes include trusting client-side extension checks, trusting MIME type headers, storing uploaded files in executable locations, or failing to enforce strict allowlists for file extensions and content inspection. In this case, the NVD further states the flaw allows Remote Code Inclusion, which suggests that uploaded content can be invoked, interpreted, or included by the application stack.
What remains unknown is important. The available sources do not establish whether exploitation is unauthenticated, whether it requires an admin feature, whether it depends on a secondary include path, or whether it leads directly to code execution. In the absence of that data, defenders should assume the practical worst case for exposed systems: a remote attacker may be able to weaponize file upload behavior to gain code execution or equivalent control over the application context.
Bottom line
CVE-2026-7852 is a critical vulnerability in Limatek System Inc. LimRAD NAC affecting versions before 5.5.7.3.9. The issue is an unrestricted upload of file with dangerous type with NVD-stated impact of Remote Code Inclusion. There is no confirmed in-the-wild exploitation from CISA KEV and no public PoC is currently known from the available sources, but that should not slow response.
If you run LimRAD NAC, the most defensible action is straightforward: verify version, upgrade to 5.5.7.3.9 or later, reduce management exposure, and review logs and file activity for signs of suspicious uploads or post-upload execution.
For further information on securing your online communications, check our guides on how to secure Microsoft Teams meetings and what is a service mesh.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.
Affected versions and patch status
The currently defensible affected version statement is simple and specific: Limatek System Inc. LimRAD NAC versions before 5.5.7.3.9 are affected. That means if you are running 5.5.7.3.8 or earlier, you should assume exposure. If your asset inventory only reports major or partial build numbers, verify the full application version directly on the appliance or host rather than relying on CMDB labels.
The fix version is likewise constrained by available evidence. The NVD wording says the issue affects versions before 5.5.7.3.9, so the safest source-backed remediation statement is: upgrade to LimRAD NAC 5.5.7.3.9 or later. At the time of writing, no authoritative patch changelog text, commit diff, or vendor technical bulletin content was available in retrievable form to provide more implementation detail.
If you cannot immediately confirm version state, treat unknown systems as potentially affected. This is especially important for older appliances, long-lived virtual appliances, or deployments managed by a third party. NAC products are often deployed once and touched infrequently, which makes version drift and untracked exposure common in SMB and mid-market environments.
How to detect suspected exploitation
Because the exact vulnerable upload path is not public in the available sources, detection should focus on behavior rather than a single URI. Start with your web server, reverse proxy, and application logs. Look for HTTP POST requests carrying multipart/form-data, especially those followed by requests for newly uploaded files or requests containing unusual extensions. Pay attention to upload activity from unfamiliar IPs, from geographies that do not match your admin base, or outside normal maintenance windows.
You should also correlate file creation events and process execution. If the application server wrote a new file into a web-accessible or application-accessible directory and that file was then requested or executed shortly after upload, that sequence is highly suspicious. On Linux-based hosts, unexpected child processes from the web server or application runtime are another important signal.
In environments with EDR, look for the application service account spawning shells, scripting engines, or file transfer tools. In network monitoring, watch for the NAC system initiating unusual outbound connections after an upload event. A successful upload-to-execution exploit often results in beaconing, package download, or command retrieval traffic shortly after initial compromise.
Technical Notes
Example log patterns and detections to hunt for:
POST /<unknown-upload-endpoint> HTTP/1.1
Content-Type: multipart/form-data; boundary=------------------------
filename="shell.jsp"
filename="test.aspx"
filename="update.war"
Simple Sigma-style logic for web logs:
title: Suspicious Multipart Upload to Management Application
status: experimental
logsource:
category: webserver
detection:
selection_method:
cs-method: POST
selection_upload:
c-useragent|contains:
- curl
- python-requests
cs-uri-query|contains:
- filename=
selection_multipart:
request_headers|contains: multipart/form-data
condition: selection_method and selection_multipart
level: high
A generic Splunk query for suspicious upload behavior:
index=web OR index=proxy
(method=POST OR cs_method=POST)
("multipart/form-data" OR request_headers="*multipart/form-data*")
| stats count min(_time) as firstSeen max(_time) as lastSeen values(uri) values(src_ip) values(user_agent) by dest_host
| sort - count
Suricata-style network signature example for multipart uploads to a management interface. This is generic, not product-path-specific, and should be tuned before production use:
alert http any any -> $HOME_NET any (
msg:"Possible suspicious multipart upload to admin application";
flow:established,to_server;
http.method; content:"POST";
http.header; content:"multipart/form-data"; nocase;
classtype:web-application-attack;
sid:10007852; rev:1;
)
Mitigation and patching guidance
The primary mitigation is to upgrade LimRAD NAC to version 5.5.7.3.9 or later. That is the only patch target supported by the available source data. If your organization has formal change windows, this issue is severe enough to justify an expedited exception, especially for externally reachable systems or systems on shared internal management networks.
If you cannot patch immediately, apply compensating controls that reduce exposure to upload functionality and management access. Because the exact endpoint is not public, assume the upload surface may be embedded in the web application. Restrict access to trusted admin IPs only, place the interface behind VPN or jump-host access, disable unnecessary public exposure, and consider temporary reverse proxy rules that block unexpected multipart upload traffic if your operations team confirms that doing so will not break core workflows.
Compensating controls are risk reduction, not remediation. A broad “block uploads” rule can help, but only if you understand whether legitimate NAC operations rely on uploads for package import, configuration restore, branding assets, or updates. Test carefully and document any temporary control so it can be removed after patching.
Technical Notes
Because no vendor-published upgrade command was available in the provided source material, defenders should use the product’s documented update process for LimRAD NAC 5.5.7.3.9 or later. If your deployment is OS-managed and package-backed, document the exact command from your internal runbook rather than improvising in production.
Examples of temporary reverse proxy restrictions for multipart traffic are below. These are generic compensating controls and must be tested before use.
Nginx example: block multipart uploads except from a trusted admin subnet.
location / {
allow 10.10.10.0/24;
deny all;
}
if ($http_content_type ~* "multipart/form-data") {
return 403;
}
Apache example: limit access to trusted addresses.
<Location />
Require ip 10.10.10.0/24
</Location>
If you manage host firewall policy directly, restrict administrative access to the NAC interface:
# Example: allow HTTPS only from admin subnet, drop others
iptables -A INPUT -p tcp -s 10.10.10.0/24 --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
After patching, validate that the running version is 5.5.7.3.9 or later, retest access restrictions, and review logs for pre-patch exploitation attempts.
References
- NVD CVE entry: https://nvd.nist.gov/vuln/detail/CVE-2026-7852
- CISA Known Exploited Vulnerabilities catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- Referenced bulletin from NVD: https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0366
- Limatek LimRAD NAC product page: https://www.limatek.com.tr/limrad-nac-product