CVE-2026-129124: C-Kermit before 11.1.515 OS Command Injection via REMOTE WHO and REMOTE SPACE

Q: Which deployments are exposed to remote exploitation?

C-Kermit servers before 11.1.515 are exposed if remote clients can issue REMOTE WHO or REMOTE SPACE requests. The vulnerability is reachable remotely and does not require authentication or user interaction according to the supplied vector.

Q: Does disabling HOST prevent exploitation?

No. The vulnerable arguments reach syscmd() through WHOCMD or SPACM2, allowing command execution even when DISABLE HOST is set.

Q: What does an attacker need to do to exploit this issue?

An attacker needs to supply unquoted arguments containing shell metacharacters to REMOTE WHO or REMOTE SPACE. Those arguments can be appended so that shell commands execute on the server host.

Q: What version addresses the vulnerability?

Upgrade C-Kermit to version 11.1.515 or later. Versions before 11.1.515 are affected.

Published Nov 13, 2026

Updated

C-Kermit before 11.1.515 contains an OS command injection vulnerability that allows remote clients to execute shell commands by supplying unquoted arguments to REMOTE WHO or REMOTE SPACE. Attackers can append shell metacharacters to arguments passed through WHOCMD or SPACM2 to syscmd(), executing commands on the server host even when DISABLE HOST is set.

Affected Software

1 affected component

Columbia University C-Kermit<11.1.515

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 11.1.515

Event History

Nov 13, 2026

CVE Published

via MITRE·04:23 PM

Data Sourced

via MITRE·04:23 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to remote exploitation?

C-Kermit servers before 11.1.515 are exposed if remote clients can issue REMOTE WHO or REMOTE SPACE requests. The vulnerability is reachable remotely and does not require authentication or user interaction according to the supplied vector.

Does disabling HOST prevent exploitation?

No. The vulnerable arguments reach syscmd() through WHOCMD or SPACM2, allowing command execution even when DISABLE HOST is set.

What does an attacker need to do to exploit this issue?

An attacker needs to supply unquoted arguments containing shell metacharacters to REMOTE WHO or REMOTE SPACE. Those arguments can be appended so that shell commands execute on the server host.

What version addresses the vulnerability?

Upgrade C-Kermit to version 11.1.515 or later. Versions before 11.1.515 are affected.

CVE-2026-129124: C-Kermit before 11.1.515 OS Command Injection via REMOTE WHO and REMOTE SPACE

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to remote exploitation?

Does disabling HOST prevent exploitation?

What does an attacker need to do to exploit this issue?

What version addresses the vulnerability?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to remote exploitation?

Does disabling HOST prevent exploitation?

What does an attacker need to do to exploit this issue?

What version addresses the vulnerability?