CVE-2026-7865 is a command injection vulnerability in a hidden console command of Crestron devices. The flaw occurs when control characters are passed to the command's second argument, allowing authenticated SSH console users to execute arbitrary OS commands. The vulnerability was discovered by a third-party researcher and affects devices accessible via SSH. No specific affected versions or patches are currently documented.