{"id":"CVE-2026-65184","title":"Avocent ACS8000 wsserver command injection","summary":"The root-privileged `wsserver` terminal-bridge daemon builds a shell command from client-supplied WebSocket fields and passes it to `system()` and `popen()` without quoting, escaping, or character-set validation. The daemon's public-key …","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-78"],"vendor":"Vertiv","product":"Avocent ACS8000","affected":["avocent_acs8000 <= 2.32.4"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-10-26T15:35:25.917894Z"},"published":"2026-10-26","updated":"2026-10-26","sourceUpdated":"2026-10-26T16:46:46.017Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-65184","references":[{"url":"https://www.runzero.com/advisories/avocent-acs8000-wsserver-cmdinj-cve-2026-65184"},{"url":"https://www.runzero.com/blog/lights-out-exposed/"}],"tags":["cve.org"],"ingestedAt":"2026-10-26T15:29:30.538Z","slug":"CVE-2026-65184","body":"## Overview\n\nThe root-privileged `wsserver` terminal-bridge daemon builds a shell command from client-supplied WebSocket fields and passes it to `system()` and `popen()` without quoting, escaping, or character-set validation. The daemon's public-key session path performs no appliance-session check.\n\n## Affected\n\n- `avocent_acs8000 <= 2.32.4`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}