CWE-78: OS Command Injection vulnerabilities

Adobe Campaign Classic contains a critical OS Command Injection vulnerability (CWE-78) that allows an unauthenticated attacker to execute arbitrary code with the privileges of the current user. This vulnerability does not require user interaction and affects the scope of the application. No patch or official remediation has been confirmed yet.

CVE-2026-55580 is an OS command injection vulnerability in sonirico's mcp-shell prior to version 0.6.0. The vulnerability arises because the default configuration disables security checks, allowing unrestricted OS command execution by any connected client. This insecure default state is documented and results from the absence of a security policy file. The issue is fixed in version 0.6.0.

CVE-2026-55581 is an OS command injection vulnerability in sonirico mcp-shell prior to version 0.6.0. The issue arises because the default Docker security.yaml allows /bin/bash in allowed_executables, but validation only checks the first token and does not block the shell command-mode flag -c. This allows an attacker to execute arbitrary commands as the mcpuser. The vulnerability is fixed in version 0.6.0.

CVE-2026-55582 is an OS command injection vulnerability in sonirico mcp-shell prior to version 0.6.0. The default security configuration allows the use of /usr/bin/git without proper argument restrictions, enabling an attacker to inject arbitrary OS commands via Git aliases. This vulnerability can be exploited by any user with MCP connectivity, as the default Docker image runs as mcpuser with Git installed and secure mode enabled. The issue is fixed in version 0.6.0.

CVE-2026-63586 is a critical OS command injection vulnerability in the Weidmueller Interface IE-SR-2TX-WL device. The web-based management interface uses a modified uhttpd server with CGI shell scripts that improperly handle the HTTP Basic Authentication username. The username is taken directly from the Authorization header without sanitization and inserted into a shell command executed via system(). An unauthenticated attacker with network access can submit a crafted username containing shell metacharacters to execute arbitrary commands with root privileges.

A stored OS command injection vulnerability exists in the parent-control module of TP-Link Archer BE3600 V1. An authenticated adjacent attacker with administrative access may store a crafted profile name containing shell metacharacters, which is later processed unsafely during daily cloud report generation and may result in arbitrary command execution. Successful exploitation may allow command execution on the affected device with potential impact to device confidentiality, integrity, and availability.

An authenticated command injection vulnerability in TP-Link Archer BE800 V1 allows an attacker with administrative access to execute arbitrary system commands with root privileges by injecting shell metacharacters via a VPN connection.  Successful exploitation may enable persistent backdoors, credential theft, LAN reconnaissance, and router-assisted attacks against connected devices.

An unauthenticated OS command injection vulnerability exists in the parental control functionality of Archer BE800 V1, BE3600 V1, and AX75 V1 due to improper filtering and neutralization of special characters in certain parameters. A LAN-based attacker can inject arbitrary commands and execute them with root privileges. Successful exploitation may result in complete device compromise and impact the confidentiality, integrity, and availability of the affected device and network traffic.

CVE-2026-76055 is a high-severity OS command injection vulnerability in Black Duck's blackduck-c-cpp package manager component prior to version 3.0.7. It allows an attacker who can create a file in the scanned build directory to execute arbitrary OS commands as the user running the scan. This occurs because filesystem paths are interpolated into shell command strings without proper quoting or escaping, enabling shell metacharacters to be interpreted. No control over the build command or tool configuration is needed for exploitation.

4MOSAn GCB Doctor by 4MOSAn Security Technology contains an OS Command Injection vulnerability. This flaw allows unauthenticated remote attackers to execute arbitrary system commands by exploiting an unremoved ADOdb test page parameter. The vulnerability has a critical severity with a CVSS score of 9.8.

CVE-2026-47359 is an OS command injection vulnerability in Apache CloudStack's NAS backup provider plugin. It affects the addBackupRepository and updateBackupRepository APIs, which accept unsanitized command options. A malicious operator account can exploit this to execute arbitrary commands on the KVM hypervisor host during backup restore operations. The vulnerability affects Apache CloudStack versions from 4.20.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0. Upgrading to versions 4.20.3.1 or 4.22.1.1 or later mitigates the issue.

CVE-2026-50112 is a high-severity OS command injection vulnerability in Apache CloudStack affecting versions from 4.14.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0. An authenticated tenant can exploit this by registering a VM template with a malicious metalink file, leading to remote code execution as root on the KVM hypervisor host. The issue arises because inner URLs in metalink XML files are not properly validated against allowed schemes. Fixed versions are 4.20.3.1 and 4.22.1.1 or later.

CVE-2026-76156 is a critical OS command injection vulnerability in Datiphy Inc.'s Data Management Center. It affects versions from 8.3.0 through 8.5.1. An authenticated administrator can exploit this flaw via the API endpoint to execute arbitrary OS commands with root privileges.

CVE-2026-18835 is a critical OS command injection vulnerability in IBM AIX versions 7.2 and 7.3, and IBM PowerVM VIOS 4.1. It allows a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements in OS commands. The vulnerability has a CVSS score of 9.9, indicating high impact on confidentiality, integrity, and availability.

CVE-2026-18824 is a high-severity vulnerability in IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 that allows a remote authenticated attacker to execute arbitrary OS commands. The issue arises from improper neutralization of special elements used in OS commands, leading to OS command injection. This vulnerability requires high privileges and user interaction to exploit and impacts confidentiality, integrity, and availability.

CVE-2026-19586 is a critical OS command injection vulnerability in TP-Link ER7212PC v2 devices configured as OpenVPN servers. It allows unauthenticated remote attackers to execute arbitrary commands by sending crafted input during OpenVPN connection establishment before authentication. Exploitation requires the OpenVPN Server feature to be enabled and reachable by the attacker. Successful exploitation could lead to full device compromise.

CVE-2026-18284 is a local privilege escalation vulnerability in the Sony XAV-9500ES device. It arises from improper validation of user-supplied input in the crash dump handler, allowing an attacker with low-privileged code execution to escalate privileges to root by executing arbitrary commands. The vulnerability is identified as CWE-78 (OS Command Injection) and affects version 3.02.00 of the product. The CVSS 3.0 score is 7.8, indicating high severity.

CVE-2026-18272 is an OS command injection vulnerability in the Kenwood DNR1007XR device, specifically in the startUpdateProcess method. It allows an attacker with physical access to execute arbitrary code as root without authentication. The vulnerability arises from improper validation of user input used in a system call. The affected version is 1.7.0003.1000. The CVSS score is 6.8, indicating a medium severity level.

CVE-2026-18268 is a local privilege escalation vulnerability in the Kenwood DNR1007XR device affecting version 1.7.0003.1000. It arises from improper validation of user-supplied input in the JKGenService component, allowing an attacker with low-privileged code execution to escalate privileges to root by injecting OS commands. The vulnerability has a high severity score of 7.0 and requires local access with high attack complexity.