ZDI-26-991: Hinemos Agent Improper Certificate Validation Remote Code Execution Vulnerability

Published Nov 13, 2026

Updated

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Hinemos Agent. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.5. The following CVEs are assigned: CVE-2026-126963.

Frequently Asked Questions

Who can exploit this issue?

A network-adjacent attacker can exploit the vulnerability. Authentication is not required.

What is the potential impact of successful exploitation?

Successful exploitation allows an attacker to execute arbitrary code on an affected Hinemos Agent installation.

How severe is this vulnerability?

ZDI assigned this issue a CVSS rating of 7.5.

ZDI-26-991: Hinemos Agent Improper Certificate Validation Remote Code Execution Vulnerability

Frequently Asked Questions

Who can exploit this issue?

What is the potential impact of successful exploitation?

How severe is this vulnerability?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the potential impact of successful exploitation?

How severe is this vulnerability?