CVE-2026-13014 Remote Code Execution vulnerability in "Suspicious" application
Remote unauthenticated attackers can execute arbitrary code and overwrite files in Thales CERT Suspicious, leading to root-level compromise.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-13014?
CVE-2026-13014 is a critical code injection vulnerability in Thales CERT Suspicious, published on 13 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability in Thales CERT "Suspicious" application =< 1.3.4 allows a remote and unauthenticated attacker to execute arbitrary code and arbitrarily overwrite writable application files—including Python modules, configuration files, cron inputs, and runtime artifacts—leading to a persistent denial of service, the potential compromise of application secrets or integrations, and root-level execution inside the Django application container. This vulnerability has been names "Matryoshka Mail". Thales PSIRT acknowledges and thanks
Lucien Doustaly (aka wlayzz) for discovering and reporting this issue.
Which versions are affected by CVE-2026-13014?
How do I fix CVE-2026-13014?
No fix has been published for CVE-2026-13014 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-13014 being exploited?
There is no known exploitation of CVE-2026-13014 in the wild and no public exploit code.