CVE-2026-116755: SoftIron HyperCloud: OS Command Injection in Orchestrator via Virtual Machine Template Fields

Published Oct 31, 2026

Updated

Improper Neutralization of Special Elements used in a Command ('Command Injection') in the Orchestrator component of SoftIron HyperCloud allows an authenticated user with access to the management plane to execute arbitrary operating system commands on hypervisor hosts as the privileged orchestration user. Attacker-controlled virtual machine template content (for example, the VM DESCRIPTION field) is delivered to hosts through a shell here-document whose terminator is not quoted, so shell expansion and here-document terminator injection are performed on that content during virtual machine lifecycle operations such as deploy, migrate, and network setup. Exploitation requires valid credentials, access to the management plane (owning a virtual machine alone is not sufficient), and a lifecycle operation that reaches the affected host. This issue affects the Orchestrator component of SoftIron HyperCloud from 1.0 through 2.6.17 and is fixed in 2.6.18.

Event History

Oct 31, 2026

CVE Published

via MITRE·01:56 AM

Data Sourced

via MITRE·01:56 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·02:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to exploitation?

Authenticated users who have valid credentials and access to the HyperCloud management plane can exploit the issue. Owning a virtual machine by itself is not sufficient; the user must be able to influence template content and trigger a lifecycle operation that reaches an affected host.

What actions can trigger the vulnerable processing?

Virtual machine lifecycle operations that deliver the attacker-controlled template content to a host can trigger it, including deploy, migrate, and network setup operations. The affected content can include fields such as the VM DESCRIPTION field.

What is the impact on a successful exploit?

A successful attacker can execute arbitrary operating system commands on hypervisor hosts as the privileged orchestration user. This can affect confidentiality, integrity, and availability of those hosts.

Which versions are affected and what version fixes the issue?

SoftIron HyperCloud Orchestrator versions 1.0 through 2.6.17 are affected. The issue is fixed in version 2.6.18.

CVE-2026-116755: SoftIron HyperCloud: OS Command Injection in Orchestrator via Virtual Machine Template Fields

Event History

Frequently Asked Questions

Who is exposed to exploitation?

What actions can trigger the vulnerable processing?

What is the impact on a successful exploit?

Which versions are affected and what version fixes the issue?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to exploitation?

What actions can trigger the vulnerable processing?

What is the impact on a successful exploit?

Which versions are affected and what version fixes the issue?