HIGH

CVE-2026-18900

2026-08-05 CVSS v3.1

CVSS

7.2

Description

A weakness has been identified in H3C NX15 V100R017. This impacts the function file.exec of the file /api/esps of the component Backend RPC. This manipulation of the argument File causes os command injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.

Weakness (CWE)

CWE-77 Command Injection

CWE-78 OS Command Injection

EPSS Score

2.38%

Probability of exploitation in next 30 days

83.2th percentile

References

https://github.com/coconut652-7/IOT_Vul_Public/blob/main/H3C/NX15R017/file_exec_root_rce/poc/postauth_file_exec_rce.py https://github.com/coconut652-7/IOT_Vul_Public/blob/main/H3C/NX15R017/file_exec_root_rce/report/postauth_file_exec_rce_report.md https://vuldb.com/cve/CVE-2026-18900 https://vuldb.com/submit/857814 https://vuldb.com/vuln/385934 https://vuldb.com/vuln/385934/cti

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE