CVE-2026-26461

Medium

Published: 01 May 2026

Published

01 May 2026

Modified

07 May 2026

KEV Added

—

Patch

—

CVSS Score 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS Score 0.0852 92.4th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-26461 is a medium-severity Command Injection (CWE-77) vulnerability in Aver PTC320UV2 (inferred from references). Its CVSS base score is 6.5 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 7.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

SI-10 directly prevents command injection by validating and sanitizing untrusted web request inputs to the management interface.

SI-2 Flaw Remediation good match

prevent

SI-2 requires timely identification, reporting, and patching of flaws like this command injection vulnerability in the web interface.

AC-3 Access Enforcement good match

prevent

AC-3 enforces logical access controls to restrict unauthenticated remote access to the vulnerable web management interface.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1059.004 Unix Shell Execution

Adversaries may abuse Unix shell commands and scripts for execution.

attack.mitre.org →

Why these techniques?

Direct remote unauthenticated command injection in a web management interface enables T1190 for initial access via public-facing application exploitation; resulting arbitrary OS command execution maps to T1059.004 Unix Shell on the embedded device.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

A Command Injection vulnerability in the web management interface in Aver PTC320UV2 0.1.0000.65 allows an unauthenticated attacker to execute arbitrary commands via a crafted web request.

Deeper analysisAI

CVE-2026-26461 is a command injection vulnerability (CWE-77) affecting the web management interface in Aver PTC320UV2 version 0.1.0000.65. It enables an unauthenticated attacker to execute arbitrary commands through a specially crafted web request. The vulnerability carries a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), indicating medium severity with network accessibility, low attack complexity, and no privileges required.

An unauthenticated attacker can exploit this vulnerability remotely over the network by sending a malicious web request to the affected web management interface. Successful exploitation allows execution of arbitrary operating system commands, potentially leading to limited impacts on confidentiality and integrity, such as data exfiltration or modification, though availability remains unaffected.

Mitigation details are available in the vendor's advisories and related resources. Security practitioners should consult the disclosure at https://github.com/spaceraccoon/disclosures/blob/main/2026/CVE-2026-26461.md and check for firmware updates or patches via the Aver downloads page at https://www.aver.com/Downloads/search?q=PTC320UV2.