CVE-2026-18811: H3C NX15 esps add command injection
Published Aug 4, 2026
·Updated
A vulnerability was detected in H3C NX15 V100R017. The affected element is the function Add of the file /api/esps. Performing a manipulation of the argument esps.filter.url results in command injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure.
Affected Software
1 affected component
H3C NX15 V100R017=V100R017
Event History
Aug 4, 2026
CVE Published
via MITRE·08:15 PM
Data Sourced
via MITRE·08:15 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·09:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-18811?
The severity of CVE-2026-18811 is classified as high with a score of 7.3.
2
How do I fix CVE-2026-18811?
To fix CVE-2026-18811, update H3C NX15 to the latest version that addresses this vulnerability.
3
What type of vulnerability is CVE-2026-18811?
CVE-2026-18811 is classified as a command injection vulnerability.
4
Can CVE-2026-18811 be exploited remotely?
Yes, CVE-2026-18811 can be exploited remotely due to its vulnerability in the H3C NX15 API.
5
What component of H3C NX15 is affected by CVE-2026-18811?
CVE-2026-18811 affects the Add function in the /api/esps file of H3C NX15.