CVE-2026-103056: AiSOC 7.2.0 before 12.0.0 Command Injection via CrowdStrike RTR
AiSOC versions 7.2.0 before 12.0.0 contain a command injection vulnerability in the actions service that builds CrowdStrike Real Time Response command strings by interpolating unescaped action parameters in crowdstrikertr.py and endpoint.py. Authenticated users can inject single quotes into filepath, path, scriptname, or scriptargs parameters to break out of quoted arguments and execute arbitrary commands on managed endpoints with SYSTEM or root privileges.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AiSOCto a version that resolves this vulnerability.Fixed in 12.0.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated AiSOC user who can supply action parameters to the affected CrowdStrike RTR actions can exploit it. The attacker must induce a CrowdStrike RTR command using a crafted single quote in file_path, path, script_name, or script_args.
What systems are at risk if exploitation succeeds?
Managed endpoints targeted through CrowdStrike Real Time Response are at risk. Injected commands can execute on those endpoints with SYSTEM privileges on Windows or root privileges on other affected endpoints.
Which AiSOC versions are affected and what version fixes the issue?
AiSOC versions from 7.2.0 up to, but not including, 12.0.0 are affected. Version 12.0.0 contains the fix.
How can we assess whether our deployment is exposed?
Confirm whether the deployed AiSOC version is earlier than 12.0.0 and whether it uses CrowdStrike RTR actions that accept file_path, path, script_name, or script_args values. Review action requests and logs for single quotes in those parameters, particularly where unexpected commands were sent to managed endpoints.