CVE-2026-71377: Command Argument Injection Vulnerability in Cosminexus Component Container
Command Argument Injection Vulnerability in Cosminexus Component Container.
This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-08, from 11-20 before 11-20-10, from 11-10 through 11-10-11, from 11-00 through 11-00-12, from 09-87 before 09-87-10, from 09-80 through 09-80-04, from 09-70 before 09-70-28, from 09-50 through 09-50-22, and from 09-00 through 09-00-18.
Affected Software
Event History
Frequently Asked Questions
Which deployments should be treated as affected?
Cosminexus Component Container deployments in the listed release ranges should be treated as affected until updated to a version outside those ranges. The affected branches span 09-00 through 11-70-01, with branch-specific fixed update levels identified in the advisory data.
Can this be exploited remotely without credentials or user interaction?
The supplied CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required. It also indicates potential high impact to confidentiality, integrity, and availability.
How can I determine whether an installation needs remediation?
Identify the installed Cosminexus Component Container version and compare it with the affected branch ranges. Versions before 11-70-03, 11-60-03, 11-20-10, 09-87-10, 09-70-28, or the other listed branch-specific fixed levels require remediation when they fall within the stated ranges.