CVE-2026-105044CWE-78command-injection

CVE-2026-105044

published October 21, 2026

CVSS
8.5
EPSS
1%
Percentile
60.4
In the wild
Unconfirmed
What it is

Improper Neutralization of Special Elements used in an OS Command in Security Toolbox versions before 20260929 in Qingteng Host Adaptive Security Platform (Host Monitoring) V3.0 allows an authenticated console administrator to execute arbitrary commands on attached clients via OS command injection

The record
Technical detail
CVSS
8.5 · NONE
CVSS v4.0
8.5 · CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H
EPSS
0.00936 · 60.4th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-10-21T05:17Z
References (1)
https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0038.md · [email protected]
EPSS history
Timeline
  • 22 OCT 03:28Z
    EPSS moved — → 1%
    epss
  • 21 OCT 01:02Z
    OS Command Injection in Qingteng Host Adaptive Security Platform Security Toolbox
    cvelistv5
  • 21 OCT 01:02Z
    OS Command Injection in Qingteng Host Adaptive Security Platform Security Toolbox
    cvelistv5