CVE-2026-76156CWE-78command-injection

CVE-2026-76156

published August 21, 2026

CVSS

9.4

EPSS

Percentile

65.4

In the wild

Unconfirmed

What it is

OS command injection in the api endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an authenticated administrator to execute arbitrary operating system commands as root.

The record

Technical detail

CVSS: 9.4 · NONE
CVSS v4.0: 9.4 · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS: 0.01100 · 65.4th percentile
Weakness: CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published: 2026-08-21T06:16Z

References (1)

https://zuso.ai/advisory · [email protected]

EPSS history

Timeline

21 AUG 01:44Z
Datiphy Data Management Center - Improper Neutralization of Special Elements used in an OS Command
cvelistv5