CVE Intelligence
Analysis AI-assisted

CVE-2026-6213: Remote Spark SparkView local connection check bypass leading to root code execution

CVE-2026-6213 affects Remote Spark SparkView before build 1122. The record describes a bypass of the local connection check that can lead to arbitrary code execution as root on the server, and the CNA scores it CVSS 4.0 10 (critical). No confirmed exploitation appears in the sources consulted, and the record lists no affected or fixed version ranges.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

A vulnerability in Remote Spark SparkView before build 1122 allows an attacker to bypass the local connection check and achieve arbitrary code execution as root on the server side. The CNA is vulnerability@ncsc.ch and the weakness is classified as CWE-290, Authentication Bypass by Spoofing.

Impact

  • The CNA assigns a CVSS 4.0 base score of 10, and the vector reports high impact to confidentiality, integrity and availability.
  • Code execution as root would likely give full control of the affected host. This is an inference from the description.
  • According to the record, exploitation may be possible without authentication depending on the implementation.

Affected products and versions

  • Product: Remote Spark SparkView.
  • Builds before 1122 are described as vulnerable. The record does not provide structured affected version ranges or product identifiers.

Exploitation status

  • The record shows CISA KEV as not listed. No confirmed exploitation appears in the sources consulted.
  • The EPSS probability is recorded as 0.00552 with a percentile of 0.44602.

Remediation and mitigation

  • Verify the installed build and update to a build newer than 1122 as stated by the vendor. See the Remote Spark product page.
  • Limit network access to SparkView services to trusted hosts until the update is applied.
  • Review whether SparkView servers are reachable from untrusted networks.

Detection guidance

  • Inventory SparkView installations and record their build numbers.
  • Review server logs for unexpected administrative activity, new processes or configuration changes made with elevated privileges.
  • Monitor connections to SparkView services for sources that are not expected.

Limitations of the available information

  • The record contains no fixed version string, no structured affected product list and no advisory text beyond the vendor reference.
  • The exact conditions for unauthenticated exploitation depend on implementation and are not described.
  • The EPSS date recorded is 2026-10-13, which is later than the publication date, so it should be verified against the EPSS source.

Frequently asked questions

What is CVE-2026-6213?

It is a vulnerability in Remote Spark SparkView before build 1122 that allows bypassing the local connection check and achieving arbitrary code execution as root on the server.

Is this CVE known to be exploited?

CISA KEV does not list it in the record, and no confirmed exploitation appears in the sources consulted.

Which versions are fixed?

The record does not list a fixed version. Builds before 1122 are described as vulnerable, so check the vendor reference for the current build.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.