Changeflow GovPing Data Privacy & Cybersecurity Vim Vulnerability - Arbitrary Code Execution Risk
Urgent Notice Added Final

Vim Vulnerability - Arbitrary Code Execution Risk

Favicon for wid.cert-bund.de CERT-Bund Security Advisories
Published March 31st, 2026
Detected April 1st, 2026
Email

Summary

CERT-Bund issued security advisory WID-SEC-2026-0940 warning of a high-severity vulnerability in Vim (Vi IMproved) text editor versions prior to 9.2.0276. The vulnerability carries a CVSS Base Score of 8.2 and allows remote anonymous attackers to execute arbitrary code. Mitigation is available; users should upgrade to the latest version.

View original document View source feed page

What changed

CERT-Bund published advisory WID-SEC-2026-0940 detailing a vulnerability in Vim text editor affecting versions below 9.2.0276. The flaw has a CVSS Base Score of 8.2 (High) and Temporal Score of 7.1, enabling remote anonymous attackers to execute arbitrary code. The vulnerability impacts Linux, UNIX, Windows, and other operating systems.

Organizations running Vim should immediately audit their systems for versions below 9.2.0276, apply the available patch to upgrade to the latest version, and verify that mitigation measures are in place. While the advisory indicates mitigation is available, no specific compliance deadline is stated. Failure to patch could expose systems to code execution attacks.

What to do next

  1. Audit systems for Vim installations below version 9.2.0276
  2. Apply available patch to upgrade Vim to version 9.2.0276 or later
  3. Verify mitigation controls are in place for vulnerable Vim instances

Source document (simplified)

[WID-SEC-2026-0940] vim: Schwachstelle ermöglicht Codeausführung CVSS Base Score 8.2 (hoch) CVSS Temporal Score 7.1 (hoch) Remoteangriff nein Datum 31.03.2026 Stand 01.04.2026 Mitigation ja

Betroffene Systeme

Betriebssystem

  • Linux
  • Sonstiges
  • UNIX
  • Windows

Produktbeschreibung

Vim (Vi IMproved) ist eine Weiterentwicklung des Texteditors vi.

Produkte

31.03.2026
- Open Source vim <9.2.0276

Angriff

Angriff

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in vim ausnutzen, um beliebigen Programmcode auszuführen. CVE Informationen Versionshistorie Feedback zum Advisory geben

Named provisions

Betroffene Systeme Angriff

Related changes

Favicon for wid.cert-bund.de Critical xz Utils Vulnerability Enables Remote Code Execution
Urgent Apr 01, 2026 • CERT-Bund Security Advisories • Data Privacy & Cybersecurity
Favicon for wid.cert-bund.de Critical cPanel Vulnerability Enables Remote Code Execution
Urgent Apr 01, 2026 • CERT-Bund Security Advisories • Data Privacy & Cybersecurity
Favicon for wid.cert-bund.de gdk-pixbuf Vulnerability - Denial of Service and Remote Code Execution Risk
Priority review Apr 01, 2026 • CERT-Bund Security Advisories • Data Privacy & Cybersecurity
Favicon for www.cert.ssi.gouv.fr Multiples vulnérabilités dans les produits Microsoft
Priority review Apr 01, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity
Favicon for www.cert.ssi.gouv.fr Chrome Vulnerabilities - Actively Exploited CVE-2026-5281
Urgent Apr 01, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity
Favicon for www.cert.ssi.gouv.fr Joomla! Multiple Vulnerabilities - SQL Injection and XSS
Priority review Apr 01, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity

Source

Favicon for wid.cert-bund.de
CERT-Bund Security Advisories wid.cert-bund.de/content/public/securityAdvisory/rss
Data Privacy & Cybersecurity
Analysis generated by AI. Source diff and links are from the original.

Classification

Agency
CERT-Bund
Published
March 31st, 2026
Instrument
Notice
Legal weight
Non-binding
Stage
Final
Change scope
Minor
Document ID
WID-SEC-2026-0940

Who this affects

Applies to
Technology companies Government agencies
Industry sector
5112 Software & Technology
Activity scope
Vulnerability Management Patch Management
Threshold
Vim <9.2.0276
Geographic scope
Germany DE

Taxonomy

Primary area
Cybersecurity
Operational domain
IT Security
Compliance frameworks
NIST CSF NIST 800-53
Topics
Data Privacy Software & Technology

Browse Categories

Agriculture & Food Safety 63 AI Regulation 3 Banking & Finance 266 Consumer & Competition 1 Consumer Protection 44 Courts & Legal 360 Data Privacy & Cybersecurity 74 Defense & National Security 52 Education 20 Energy 107 Environment 85 Government & Legislation 302 Healthcare 136 Housing 16 Immigration 9 Insurance 58 Labor & Employment 113 Legal & Courts 1 Pharma & Drug Safety 103 Securities & Markets 104 Tax 65 Tax & Revenue 1 Telecom & Technology 47 Trade & Sanctions 124 Transportation 57

Get Data Privacy & Cybersecurity alerts

Weekly digest. AI-summarized, no noise.

Free. Unsubscribe anytime.

Get alerts for this source

We'll email you when CERT-Bund Security Advisories publishes new changes.

Optional. Personalizes your daily digest.

Free. Unsubscribe anytime.