CVE-2026-116755
Received Received - Intake

Command Injection in SoftIron HyperCloud Orchestrator

Publication date: 2026-10-31

Last updated on: 2026-10-31

Assigner: SoftIron

Description
Improper Neutralization of Special Elements used in a Command ('Command Injection') in the Orchestrator component of SoftIron HyperCloud allows an authenticated user with access to the management plane to execute arbitrary operating system commands on hypervisor hosts as the privileged orchestration user. Attacker-controlled virtual machine template content (for example, the VM DESCRIPTION field) is delivered to hosts through a shell here-document whose terminator is not quoted, so shell expansion and here-document terminator injection are performed on that content during virtual machine lifecycle operations such as deploy, migrate, and network setup. Exploitation requires valid credentials, access to the management plane (owning a virtual machine alone is not sufficient), and a lifecycle operation that reaches the affected host. This issue affects the Orchestrator component of SoftIron HyperCloud from 1.0 through 2.6.17 and is fixed in 2.6.18.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-31
Last Modified
2026-10-31
Generated
2026-10-31
AI Q&A
2026-10-31
EPSS Evaluated
N/A
NVD
CVE-2026-116755
EUVD
EUVD-2026-114571

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
SoftIron HyperCloud 1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a command injection vulnerability in SoftIron HyperCloud's Orchestrator component. An authenticated user with management plane access can execute arbitrary OS commands on hypervisor hosts as a privileged user. Attacker-controlled content in VM templates (like the VM description field) is processed unsafely during VM operations such as deploy or migrate, allowing shell expansion and command injection.

Detection Guidance

Check HyperCloud Orchestrator logs for suspicious VM lifecycle operations involving template content delivery. Monitor for unauthorized command execution attempts in system logs, particularly during deploy, migrate, or network setup operations. Review shell here-document terminators in VM template fields for improper quoting.

Impact Analysis

An attacker with valid credentials and management plane access could gain control over hypervisor hosts, potentially compromising all virtual machines running on those hosts. This could lead to data theft, service disruption, or further network compromise. Exploitation requires specific access and conditions but enables significant system control.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Organizations using affected versions may face compliance violations, legal penalties, and reputational damage due to potential exposure of sensitive data.

Mitigation Strategies

Upgrade HyperCloud Orchestrator to version 2.6.18 or later immediately. Restrict management plane access to only necessary users. Audit VM template content for suspicious fields like VM DESCRIPTION. Implement strict input validation for template fields to prevent command injection.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116755. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart