CVE-2026-26461

Medium

Published: 01 May 2026

Published

01 May 2026

Modified

07 May 2026

KEV Added

—

Patch

—

CVSS Score v3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS Score 0.1066 93.5th percentile

Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-26461 is a medium-severity Command Injection (CWE-77) vulnerability in Aver PTC320UV2 (inferred from references). Its CVSS base score is 6.5 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 6.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2026-26461 is a command injection vulnerability (CWE-77) affecting the web management interface in Aver PTC320UV2 version 0.1.0000.65. It enables an unauthenticated attacker to execute arbitrary commands through a specially crafted web request. The vulnerability carries a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), indicating medium severity with network accessibility, low attack complexity, and no privileges required.

An unauthenticated attacker can exploit this vulnerability remotely over the network by sending a malicious web request to the affected web management interface. Successful exploitation allows execution of arbitrary operating system commands, potentially leading to limited impacts on confidentiality and integrity, such as data exfiltration or modification, though availability remains unaffected.

Mitigation details are available in the vendor's advisories and related resources. Security practitioners should consult the disclosure at https://github.com/spaceraccoon/disclosures/blob/main/2026/CVE-2026-26461.md and check for firmware updates or patches via the Aver downloads page at https://www.aver.com/Downloads/search?q=PTC320UV2.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-26701

Vulnerability details

A Command Injection vulnerability in the web management interface in Aver PTC320UV2 0.1.0000.65 allows an unauthenticated attacker to execute arbitrary commands via a crafted web request.

CWE(s): CWE-77

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1059.004 Unix Shell Execution

Adversaries may abuse Unix shell commands and scripts for execution.

attack.mitre.org →

Why these techniques?

Direct remote unauthenticated command injection in a web management interface enables T1190 for initial access via public-facing application exploitation; resulting arbitrary OS command execution maps to T1059.004 Unix Shell on the embedded device.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1