Command Execution Vulnerability in Epic Games Unreal Engine
CVE-2026-14765

7.7HIGH

Key Information:

Vendor

Epic Games

Status
Unreal Engine
Vendor
CVE Published:
14 October 2026

What is CVE-2026-14765?

Epic Games Unreal Engine prior to version 5.9.0 is affected by a severe configuration issue where the LaunchURL Blueprint node does not implement a URL scheme filter, allowing for arbitrary command execution through file URIs. This vulnerability arises from instantiating resources with insecure defaults, enabling potential exploitation via user-generated content containing malicious Blueprints. Attackers can manipulate this flaw to execute commands either from a local file or through a remote WebDAV share, significantly compromising application security.

Affected Version(s)

Unreal Engine 0 <= 5.8.0

References

https://khaelkugler.com/blogs/meccha_chameleon.html
related
https://takeonme.org/gcves/GCVE-1337-2026-000000000000000...
third-party-advisory

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Khael Kugler
todb of AHA!
.