Is CVE-2026-86177 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-86177?

CVE-2026-86177 has a CVSS v3 severity of HIGH (8.8).

Back

CVE-2026-86177

Description

Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subusers with only schedule.update permission to execute arbitrary console commands. Attackers can create and immediately trigger scheduled tasks that run game-server console commands, control server power state, or create backups without proper authorization checks.