CVE-2026-74895 is a critical vulnerability in the jahlives openssl_encrypt product affecting versions prior to 1.4.0. The flaw causes sandbox restrictions to be bypassed in the default process isolation mode for plugin execution. This failure enables attackers to run malicious plugins with full access to system resources including filesystem, network, subprocesses, and Python modules, significantly increasing the potential impact of exploitation. The vulnerability has a CVSS 4.0 base score of 9.3, indicating high severity and ease of exploitation without privileges or user interaction. No patch or official remediation level is currently documented.

Successful exploitation allows an attacker to execute malicious plugins without sandbox restrictions, granting unrestricted access to the filesystem, network, subprocess execution, and all Python modules. This can lead to full system compromise, data theft, or disruption of services.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict plugin execution to trusted sources and consider disabling plugin functionality if feasible to reduce risk.