CVE-2026-64878
A critical vulnerability allows attackers to inject shell commands through unvalidated asset filter parameters in a REST endpoint. This flaw lets them run arbitrary code on the server as a low‑privileged operating‑system user. The issue is severe because it can be triggered remotely without authentication.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
The vulnerability affects any software that implements an Analysis REST endpoint with asset filter parameters that do not properly escape shell metacharacters. No specific product versions are listed, so the impact could apply to a range of systems using this feature.
Real-world impact
An attacker who can reach the vulnerable endpoint can execute arbitrary shell commands on the host machine, potentially compromising the entire system, exfiltrating data, or pivoting to other services.
Why this severity
The CVSS score of 9.4 reflects a high‑impact, remote exploitation scenario. The vulnerability allows remote code execution with low privileges, and the impact is considered high for confidentiality, integrity, and availability because the attacker can run commands that affect the whole system.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jul 21, 2026 · 11d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 24, 2026 · 9d agoAdvisory updatedThe NVD record was last revised.