CVE-2026-65184

The Avocent ACS8000 is vulnerable to an OS command injection flaw in its root-privileged wsserver terminal-bridge daemon. The daemon constructs shell commands using client-supplied WebSocket fields and passes them to system() and popen() functions without proper quoting, escaping, or character-se...

CVE-2026-65184 Avocent ACS8000 wsserver command injection

The root-privileged wsserver terminal-bridge daemon builds a shell command from client-supplied WebSocket fields and passes it to system and popen without quoting, escaping, or character-set validation. The daemon's public-key session path performs no appliance-session check...