The vulnerability CVE-2026-14736 affects Ruijie RG-UAC versions up to 1.0-R1.8.2.p5. It is caused by insufficient restrictions on the upload_image parameter in the user_auth_commit.php file, allowing an attacker to perform unrestricted file uploads remotely. This could potentially lead to unauthorized file uploads on the affected system. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. No official fix or remediation level has been published by the vendor as of the data provided.

Successful exploitation allows remote attackers to upload files without restriction, which could lead to unauthorized file placement on the system. This may facilitate further attacks such as code execution or system compromise depending on the uploaded file and system configuration. However, no confirmed exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected functionality where possible and monitor for suspicious file uploads. Avoid exposing the vulnerable endpoint to untrusted networks.