CVE-2026-7849CWE-77

Command Injection in SCM (idledisconnect parameter)

Critical · published July 30, 2026

CVSS v4.0
9.3
EPSS
1%
Percentile
54.6
In the wild
Unconfirmed
What it is

Due to improper neutralization of special elements, an unauthenticated remote attacker is able to inject a command into the system configuration which is subsequently executed as root.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00754 · 54.6th percentile
Weakness
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published
2026-07-30T06:54Z
EPSS history
Timeline
  • 30 JUL 06:54Z
    Command Injection in SCM (idledisconnect parameter)
    cvelistv5