CVE-2026-4170
Published: 16 March 2026
Summary
CVE-2026-4170 is a high-severity Command Injection (CWE-77) vulnerability in Feishu (inferred from references). Its CVSS base score is 8.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 21.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-4170 is an OS command injection vulnerability affecting Topsec TopACM 3.0. The issue resides in an unknown functionality of the file /view/systemConfig/management/nmc_sync.php within the HTTP Request Handler component. By manipulating the template_path argument in an HTTP request, an attacker can inject and execute arbitrary operating system commands.
The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it is exploitable remotely over the network with low complexity, no privileges, and no user interaction required. Remote attackers can achieve high impacts on confidentiality, integrity, and availability, potentially leading to full system compromise. An exploit is publicly available and could be used in attacks.
Advisories from sources like VulDB note that the vendor was contacted early about the disclosure but did not respond, implying no official patches or mitigations are available at this time. Security practitioners should review the referenced advisories for additional details.
Notable context includes the public availability of the exploit, increasing the risk of real-world attacks against exposed Topsec TopACM 3.0 instances.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-12214
Vulnerability details
A weakness has been identified in Topsec TopACM 3.0. Affected by this vulnerability is an unknown functionality of the file /view/systemConfig/management/nmc_sync.php of the component HTTP Request Handler. Executing a manipulation of the argument template_path can lead to os command injection.…
more
The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated OS command injection in a public-facing web application (HTTP Request Handler) directly enables T1190 (Exploit Public-Facing Application) for initial access and T1059 (Command and Scripting Interpreter) for arbitrary command execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents OS command injection by enforcing input validation mechanisms on the template_path parameter in HTTP requests to block malicious command payloads.
Enforces approved authorizations on the vulnerable /view/systemConfig/management/nmc_sync.php endpoint, blocking unauthenticated remote access required for exploitation.
Mandates timely identification, reporting, and correction of the specific command injection flaw in Topsec TopACM 3.0, including workarounds given lack of vendor patch.