CVE-2026-26068: emp3r0r Agent-Controlled Metadata to Operator RCE (tmux Command Injection)
Vulnerability summary
CVE-2026-26068 is a critical (CVSS 9.9) vulnerability in jm33-m0 emp3r0r. EPSS estimates a 3.79% chance of exploitation in the next 30 days, higher than 90% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (GitHub, Date unknown)
Source freshness unavailable
How is this decided?Timeline
- 12-02-2026PublishedVulnerability first disclosed.
- 13-02-2026Last modifiedVulnerability information updated.
Description
emp3r0r is a stealth-focused C2 designed by Linux users for Linux environments. Prior to 3.21.1, untrusted agent metadata (Transport, Hostname) is accepted during check-in and later interpolated into tmux shell command strings executed via /bin/sh -c. This enables command injection and remote code execution on the operator host. This vulnerability is fixed in 3.21.1.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST9.3CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
Probability
3.79%
Chance of exploitation in the next 30 days
Percentile
90%
Versus all other CVEs
30-day change
No change 0.00 pp
From 3.79% on 05-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundEmp3R0R
Maturity: poc
Weaknesses
CWE · root cause- CWE-77Improper Neutralization of Special Elements used in a CommandThe product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
- CWE-78Improper Neutralization of Special Elements used in an OS CommandThe product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command before it is sent to a downstream component.
Affected systems
Known conditions: network-reachable, low-privilege account, user interaction (CVSS vector). Other conditions: not stated in public data.
Jm33-m01 product
- emp3r0r< 3.21.1
1 vendor · 1 product
References
3 links- github.com/jm33-m0/emp3r0r/security/advisories/GHSA-h5p4-4xp4-vjppX Refsource CONFIRMExploitVendor Advisory