CVE-2026-77120: OS Command Injection
Published Sep 9, 2026
·Updated
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause privilege escalation to root and unauthorized execution of administrative functions when an authenticated user with SSH enabled interacts with the operating system console that improperly processes user-controlled input.
Event History
Sep 9, 2026
CVE Published
via MITRE·04:31 PM
Data Sourced
via MITRE·04:31 PM
DescriptionWeakness
Frequently Asked Questions
1
What access does an attacker need to exploit this issue?
The attacker must be an authenticated user, have SSH enabled, and interact with the operating system console using input that is improperly processed.
2
Which environments are exposed based on the available information?
Systems are exposed where SSH is enabled and authenticated users can interact with the affected operating system console. The available information does not state whether SSH is enabled by default.