CVE-2026-35847 is a critical code execution vulnerability in dnsmgr versions up to and including 2.15. It arises from improper handling in the ping function of the CheckUils.php file, allowing a local attacker to execute arbitrary code. The vulnerability is classified under CWE-77 (Improper Neutralization of Special Elements used in a Command). No official patch or remediation details are provided in the available data.

Successful exploitation allows an attacker with local access to execute arbitrary code, potentially leading to full system compromise. The CVSS vector indicates the attack can be performed remotely without privileges or user interaction, but the description specifies local attacker, suggesting local access is required. The impact includes complete confidentiality, integrity, and availability loss.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, restrict local access to trusted users only and consider disabling or restricting use of the vulnerable ping function in CheckUils.php if possible.