{"id":"CVE-2026-61554","title":"emp3r0r is a C2 designed by Linux users for Linux environments","summary":"emp3r0r is a C2 designed by Linux users for Linux environments. Prior to version 4.2.5, the `http_poll` C2 transport accepts attacker-controlled HTTP polling sessions before CBOR `MsgAuth` authentication is completed. A remote unauthenti…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-400"],"vendor":"jm33-m0","product":"github.com/jm33-m0/emp3r0r/core","affected":["github.com/jm33-m0/emp3r0r/core < 0.0.0-20260531142011-aed3d81641ab"],"patched":["github.com/jm33-m0/emp3r0r/core 0.0.0-20260531142011-aed3d81641ab"],"published":"2026-09-15","updated":"2026-09-16","sourceUpdated":"2026-09-16T19:17:22.020","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-61554","references":[{"url":"https://github.com/jm33-m0/emp3r0r/releases/tag/v4.2.5","label":"security-advisories@github.com"},{"url":"https://github.com/jm33-m0/emp3r0r/security/advisories/GHSA-4595-rvpx-4q34","label":"security-advisories@github.com"},{"url":"https://github.com/jm33-m0/emp3r0r/security/advisories/GHSA-4595-rvpx-4q34","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/advisories/GHSA-4595-rvpx-4q34"},{"url":"https://github.com/jm33-m0/emp3r0r"}],"tags":["nvd","ghsa","go","cve.org","osv","exploit-available"],"aliases":["GHSA-4595-rvpx-4q34"],"ecosystem":"go","exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-16T17:59:27.422568Z"},"ingestedAt":"2026-09-15T21:44:50.635Z","epss":0.00549,"epssPercentile":0.446,"slug":"CVE-2026-61554","body":"## Overview\n\nemp3r0r is a C2 designed by Linux users for Linux environments. Prior to version 4.2.5, the `http_poll` C2 transport accepts attacker-controlled HTTP polling sessions before CBOR `MsgAuth` authentication is completed. A remote unauthenticated attacker can create arbitrary polling sessions and send request bodies that are forwarded into the C2 dispatch path. This can consume server resources and trigger pre-auth C2 processing. Version 4.2.5 patches the issue.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-61554)\n\nAffected packages:\n\n- `github.com/jm33-m0/emp3r0r/core < 0.0.0-20260531142011-aed3d81641ab`\n\nPatched in:\n\n- `github.com/jm33-m0/emp3r0r/core 0.0.0-20260531142011-aed3d81641ab`\n\nSource: https://github.com/advisories/GHSA-4595-rvpx-4q34","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":205687,"id":"CVE-2026-61554","ts":1789585402364,"field":"exploit_available","old":"false","new":"true"}]}