CVE-2026-65184: Avocent ACS8000 wsserver command injection
Deferred
Published 26-10-2026Last modified 26-10-2026
Vulnerability summary
CVE-2026-65184 is a critical (CVSS 9.8) OS Command Injection vulnerability in vertiv avocent acs8000.
CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)EPSS scoreNot scoredRisk metrics not yet published.
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Timeline
- 26-10-2026PublishedVulnerability first disclosed.
- 26-10-2026Last modifiedVulnerability information updated.
Description
The root-privileged `wsserver` terminal-bridge daemon builds a shell command from client-supplied WebSocket fields and passes it to `system()` and `popen()` without quoting, escaping, or character-set validation. The daemon's public-key session path performs no appliance-session check.
CVSS metrics
2 scores · 2 sources · 1 versionCritical 9.8Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesAll 2 agree
- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Vertiv1 product
- avocent acs8000≤ 2.32.4
1 vendor · 1 product
References
2 links- www.runzero.com/advisories/avocent-acs8000-wsserver-cmdinj-cve-2026-65184Third Party Advisory