Threats tagged 'ghsa-qhpq-4pf4-cqxv'

CVE-2026-116755 is a command injection vulnerability in the Orchestrator component of SoftIron HyperCloud versions 1.0 through 2.6.17. It allows an authenticated user with management plane access to execute arbitrary OS commands on hypervisor hosts as a privileged user. The flaw arises from improper neutralization of special elements in VM template content, enabling shell expansion and injection during VM lifecycle operations. The issue is fixed in version 2.6.18.