CVE-2026-18900: H3C NX15 Backend RPC esps file.exec os command injection
A weakness has been identified in H3C NX15 V100R017. This impacts the function file.exec of the file /api/esps of the component Backend RPC. This manipulation of the argument File causes os command injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18900?
The severity of CVE-2026-18900 is rated as high with a score of 7.2.
How do I fix CVE-2026-18900?
To mitigate CVE-2026-18900, update your H3C NX15 software to the latest version that addresses this vulnerability.
What type of vulnerability is CVE-2026-18900?
CVE-2026-18900 is classified as an OS Command Injection vulnerability.
Can CVE-2026-18900 be exploited remotely?
Yes, CVE-2026-18900 can be exploited remotely due to its nature of command injection through the Backend RPC.
What component is impacted by CVE-2026-18900?
CVE-2026-18900 impacts the file.exec function of the /api/esps file in the Backend RPC component.