Cyber Resilience

CVE-2026-48163

HighRCEUpdated

Published: 12 June 2026

Published
12 June 2026
Modified
30 June 2026
KEV Added
—
Patch
—
CVSS Score v3.1 8.0 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0069 48.4th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-48163 is a high-severity OS Command Injection (CWE-78) vulnerability in Mariadb Mariadb. Its CVSS base score is 8.0 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Unix Shell (T1059.004); ranked at the 48.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

A05:2025 Injection

EU & UK References

Vulnerability details

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, during the SST the donor node is interpolating parameters that…

more

the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the rsync SST method. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2.

CWE(s)
CWE-78

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
Why these techniques?

CWE-78 OS command injection in rsync SST allows direct arbitrary Unix shell command execution on donor node.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

Affected Assets

mariadb
mariadb
12.3.1 · 10.6.1 — 10.6.27 · 10.11.1 — 10.11.18 · 11.4.1 — 11.4.12

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SC-27 Platform-independent Applications
addresses: CWE-78

Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.

SI-10 Information Input Validation
addresses: CWE-78

Validates inputs to block special elements that would alter OS command execution.

References