CVE-2026-26068CWE-77CWE-78

emp3r0r Agent-Controlled Metadata to Operator RCE (tmux Command Injection)

Critical · published February 12, 2026

CVSS v4.0
9.3
EPSS
4%
Percentile
90.8
In the wild
Unconfirmed
What it is

emp3r0r is a stealth-focused C2 designed by Linux users for Linux environments. Prior to 3.21.1, untrusted agent metadata (Transport, Hostname) is accepted during check-in and later interpolated into tmux shell command strings executed via /bin/sh -c. This enables command injection and remote code execution on the operator host. This vulnerability is fixed in 3.21.1.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.04144 · 90.8th percentile
Weaknesses
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection'); CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-02-12T22:01Z
EPSS history
Timeline
  • 12 FEB 22:01Z
    emp3r0r Agent-Controlled Metadata to Operator RCE (tmux Command Injection)
    cvelistv5