CVE-2026-84811 agentverus-scanner Companion Code Analysis Bypass via Excluded Python Bytecode
Attackers bypass security scanning by hiding malicious Python bytecode in excluded directories, enabling arbitrary code execution while receiving a certified verdict.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-84811?
CVE-2026-84811 is a high-severity vulnerability in agentverus-scanner, published on 2 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
agentverus-scanner fails to analyze compiled Python bytecode files in companion code directories, allowing attackers to bypass security scanning by shipping malicious __pycache__ entries alongside benign source files. Attackers can execute arbitrary Python bytecode on import while the scanner reports a CERTIFIED verdict with high trust scores in both static and semantic analysis modes.
Weakness: CWE-693
Which versions are affected by CVE-2026-84811?
How do I fix CVE-2026-84811?
No fix has been published for CVE-2026-84811 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-84811 being exploited?
There is no known exploitation of CVE-2026-84811 in the wild and no public exploit code.
Sources
Also known as GHSA-7r9q-g8p5-w7pp.