CVE-2026-18814: H3C NX15 esps reload.reload_config command injection

Published Aug 4, 2026

Updated

A vulnerability was found in H3C NX15 V100R017. This impacts the function reload.reloadconfig of the file /api/esps. The manipulation results in command injection. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.

Affected Software

1 affected component

H3C NX15=V100R017

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade H3C NX15 to a version that resolves this vulnerability.
Fixed in V100R017

Event History

Aug 4, 2026

CVE Published

via MITRE·09:15 PM

Data Sourced

via MITRE·09:15 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-18814?

The severity of CVE-2026-18814 is classified as high with a score of 7.2.

How do I fix CVE-2026-18814?

To fix CVE-2026-18814, ensure you update the H3C NX15 to the latest version released by the vendor.

What type of vulnerability is CVE-2026-18814?

CVE-2026-18814 is a command injection vulnerability.

Can CVE-2026-18814 be exploited remotely?

Yes, CVE-2026-18814 can be exploited remotely.

What component of H3C NX15 is affected by CVE-2026-18814?

CVE-2026-18814 affects the reload.reload_config function in the /api/esps file.