Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
The root-privileged wsserver terminal-bridge daemon builds a shell command from client-supplied WebSocket fields and passes it to system() and popen() without quoting, escaping, or character-set validation. The daemon's public-key session path performs no appliance-session check.
An unauthenticated attacker over the network can send malicious WebSocket messages to inject shell metacharacters into command construction, executing arbitrary OS commands with root privileges on the affected appliance.
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Update Vertiv Avocent ACS8000 to version 2.32.5 or later. Restrict network access to the wsserver daemon to trusted management interfaces. Implement network segmentation to limit exposure of the affected appliance.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Feedly found the first article mentioning CVE-2026-65184 . See article
NVD published the first details for CVE-2026-65184
A CVSS base score of 9.8 has been assigned.
GitHub Advisories released a security advisory .
[GHSA-f563-j7vj-6j8f] The root-privileged `wsserver` terminal-bridge daemon builds a shell command fro
CVE-2026-113345 - Exploits & Severity - Feedly
CVE-2026-65184 - Exploits & Severity - Feedly
61 changes (10 new | 51 updated):
CVE-2026-65184 exploit
Be the first to know critical vulnerabilities
Collect, analyze, and vulnerability reports faster using AI
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
