CVE-2026-103038: PingTools Network Utilities 4.64 - OS command injection through Watcher ICMP host
Published Oct 19, 2026
·Updated
PingTools Network Utilities 4.64 Free accepts an arbitrary value in the Host field of a Watcher ICMP service, incorporating that value into a command string executed as sh -c.
Affected Software
1 affected component
PingTools PingTools Network Utilities=4.64
Event History
Oct 19, 2026
CVE Published
via MITRE·04:13 PM
Data Sourced
via MITRE·04:13 PM
DescriptionWeakness
Data Sourced
via NVD·05:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What access does an attacker need to exploit this issue?
The attacker needs to be able to supply an arbitrary Host value for a Watcher ICMP service in the Free edition of PingTools Network Utilities 4.64.
2
What component processes the attacker-controlled value?
The Watcher ICMP service incorporates the Host field value into a command string that is executed through sh -c.