CVE-2026-45777
Open XDMoD Vulnerable to Unauthenticated Remote Code Execution (RCE) via OS Command Injection
Vexday Risk Score
48Atenção
Decisão SSVC (CISA)
Attend
PoC disponível → acompanhar de perto
Maturidade do exploit
Prova de conceito
Existe prova de conceito pública, mas ainda não automatizada.
CVSS 9.3EPSS 0.4%KEV nãoPoC públicaNuclei —Metasploit —Patch —
Ciclo de vida
05 jun 2026Publicada no NVD
17 jun 2026PoC pública
Velocidade de armamento
12 diasaté o primeiro PoC
Recomendação: Planejar correção próxima — já existe PoC pública.
OpenXDMoD is an open framework for collecting and analyzing HPC metrics. Starting in version 9.5.0 and prior to version 11.0.3, an attacker can remotely execute arbitrary system commands on the web server hosting Open XDMoD with the privileges of the web server process. This could allow an attacker to read or modify application data, alter system configuration, or disrupt service availability. All deployments of Open XDMoD versions 9.5.0 through 11.0.2 (inclusive) are impacted. This issue was reported privately on 2026-04-06, and at this time there is no evidence that this vulnerability has been exploited in the wild. The vulnerability was patched in Open XDMoD 11.0.3 on 2026-05-12. As a workaround, apply the patch manually.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
ubccr · xdmodPoCs públicas encontradas — 1
githubgithub.com/morepoints/CVE-2026-45777★ 0⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.