CVE-2026-14765

Epic Games Unreal Engine versions up to and including 5.8.0 ship with an insecure default configuration for the LaunchURL Blueprint node (UKismetSystemLibrary::LaunchURL). The URL scheme filter (FURLRequestFilter) is empty by default, which permits all URL schemes. On Windows, this results in a call to ShellExecuteW() with the open verb, so a supplied file:/// URI causes the referenced file to be executed. Any Unreal Engine game that loads user-generated content containing Blueprints is vulnerable to command execution via a malicious local file or a remote file on a WebDAV share. This is an instance of CWE-1188 (Initialization of a Resource with an Insecure Default).

• CWE-1188

• https://khaelkugler.com/blogs/meccha_chameleon.html
• https://takeonme.org/gcves/GCVE-1337-2026-00000000000000000000000000000000000000000000000001011111111101111111111110000000000000000000000000000000000000000000000000000001011

Published

Oct 14, 2026

Last Modified

Oct 18, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-1476An out-of-band SQL injection vulnerability (OOB SQLi) has be…7.5
• CVE-2026-14760A weakness has been identified in radareorg radare2 up to 6.…7.8
• CVE-2026-14761A security vulnerability has been detected in radareorg rada…5.5
• CVE-2026-14762A vulnerability was detected in code-projects Hotel and Tour…7.3
• CVE-2026-14763A flaw has been found in code-projects Hotel and Tourism Res…7.3
• CVE-2026-14764A vulnerability has been found in code-projects Hotel and To…7.3
• CVE-2026-14766A vulnerability was identified in CodeAstro Apartment Visito…6.3
• CVE-2026-14767A security flaw has been discovered in CodeAstro Ecommerce W…6.3
• CVE-2026-14768A weakness has been identified in code-projects Real State S…7.3
• CVE-2026-14769A security vulnerability has been detected in code-projects …7.3
• CVE-2026-1477An out-of-band SQL injection vulnerability (OOB SQLi) has be…7.5
• CVE-2026-14770A vulnerability was detected in SourceCodester Class and Exa…7.3