CVE-2026-18814: Command Injection in H3C NX15
CVE-2026-18814 is a command injection vulnerability in the H3C NX15 device, specifically impacting the reload.reload_config function in the /api/esps file. This vulnerability allows remote attackers with high privileges to execute arbitrary commands. The exploit code has been publicly disclosed. No official patch or remediation guidance has been provided by the vendor yet.
AI Analysis
Technical Summary
This vulnerability affects the H3C NX15 device running version V100R017. The flaw exists in the reload.reload_config function of the /api/esps endpoint, where improper input handling leads to command injection. An attacker with high privileges can remotely exploit this vulnerability to execute arbitrary commands on the affected device. The exploit has been publicly released, increasing the risk of exploitation. The vendor was notified early, but no patch or official remediation has been announced as of the publication date.
Potential Impact
Successful exploitation allows remote command execution with high privileges on the affected H3C NX15 device. This can lead to full system compromise, unauthorized control, and potential disruption of network operations. The vulnerability has a high CVSS score of 8.6, indicating significant severity.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected API endpoint and limit administrative privileges to trusted users only. Monitor for any updates from the vendor regarding patches or workarounds.
CVE-2026-18814: Command Injection in H3C NX15
Description
CVE-2026-18814 is a command injection vulnerability in the H3C NX15 device, specifically impacting the reload.reload_config function in the /api/esps file. This vulnerability allows remote attackers with high privileges to execute arbitrary commands. The exploit code has been publicly disclosed. No official patch or remediation guidance has been provided by the vendor yet.
CVSS v4.0
Score 8.6high
Affected software
H3C
NX15
cpe:2.3:a:h3c:nx15:*:*:*:*:*:*:*:*AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability affects the H3C NX15 device running version V100R017. The flaw exists in the reload.reload_config function of the /api/esps endpoint, where improper input handling leads to command injection. An attacker with high privileges can remotely exploit this vulnerability to execute arbitrary commands on the affected device. The exploit has been publicly released, increasing the risk of exploitation. The vendor was notified early, but no patch or official remediation has been announced as of the publication date.
Potential Impact
Successful exploitation allows remote command execution with high privileges on the affected H3C NX15 device. This can lead to full system compromise, unauthorized control, and potential disruption of network operations. The vulnerability has a high CVSS score of 8.6, indicating significant severity.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected API endpoint and limit administrative privileges to trusted users only. Monitor for any updates from the vendor regarding patches or workarounds.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-08-04T12:46:18.289Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a725cbabf8831d5398274be
Added to database: 08/04/2026, 21:42:18 UTC
Last enriched: 08/12/2026, 15:46:08 UTC
Last updated: 09/17/2026, 22:01:33 UTC
Views: 71
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.