Skip to content
Critical OS Command Injection Vulnerability Discovered in Vertiv Avocent ACS8000

Critical OS Command Injection Vulnerability Discovered in Vertiv Avocent ACS8000

First seen 27 Oct 2026, 01:26 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 27, 2026 at 10:43 UTC
  • •CVE-2026-65184 has a CVSS score of 9.8, marking it as critical.
  • •The vulnerability allows remote command execution with root privileges via WebSocket messages.
  • •No public proof-of-concept or confirmed exploitation has been reported yet.

A critical vulnerability, CVE-2026-65184, has been identified in the Vertiv Avocent ACS8000 appliance. The flaw arises from the root-privileged `wsserver` terminal-bridge daemon, which improperly constructs shell commands from unvalidated WebSocket inputs. This allows unauthenticated attackers to execute arbitrary OS commands with root privileges remotely. The vulnerability has been assigned a CVSS score of 9.8, indicating its critical nature. Currently, there is no public proof-of-concept or confirmed exploitation reported. Users are advised to update to version 2.32.5 or later and restrict network access to the affected daemon. The vulnerability was published on October 26, 2026, by multiple sources, including Feedly and Sploitus.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-26
CVE-2026-65184 published
Details of the critical OS command injection vulnerability in Vertiv Avocent ACS8000 were disclosed.
Feedly
2026-10-26
Security advisory released
GitHub Advisories published a security advisory for CVE-2026-65184, urging updates and network restrictions.
Sploitus

More articles in this cluster (3)

Following this threat?

Track CVE-2026-113345 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (6)

1 / 4

Common questions

What systems are affected by CVE-2026-65184?
The vulnerability affects the Vertiv Avocent ACS8000 appliance running versions prior to 2.32.5.
What should I do to protect my systems?
Update the affected appliance to version 2.32.5 or later and restrict access to the wsserver daemon.
Is there any evidence of exploitation in the wild?
No evidence of exploitation has been reported as of now.