Remote Code Execution via Improper Input Validation in rcourtman Pulse

A high-severity security vulnerability, identified as CVE-2026-92860, has been disclosed in the rcourtman Pulse application. The flaw resides within the Quick Security Setup Handler, specifically affecting the fmt.Sprintf function inside the /api/security/quick-setup endpoint. The vulnerability is caused by improper input validation of the Username argument, which can be manipulated by a remote, unauthenticated attacker. This flaw poses a significant risk to affected installations, as it potentially allows for remote code execution or unauthorized system manipulation. The issue affects all versions of rcourtman Pulse up to 6.0.4 and 6.1.0-rc.4. Organizations running these versions are advised to upgrade immediately to a patched release once available to mitigate the risk of remote exploitation.

Impact

The vulnerability carries a CVSS v3.1 base score of 9.1, indicating a critical risk of full system compromise for internet-facing installations. Successful exploitation allows remote attackers to bypass security controls by injecting malicious payloads into the Username field during the quick setup process, potentially leading to unauthorized data access, system disruption, or complete control over the host running the Pulse software.

Recommendation

Prioritize the upgrade of all internet-facing instances of rcourtman Pulse to a version beyond 6.0.4 or 6.1.0-rc.4. Detection engineering teams should monitor web server logs for suspicious or unusually long strings contained within the Username parameter of POST requests directed at /api/security/quick-setup.