CVE-2026-65184
Received Received - Intake

wsserver Terminal-Bridge Command Injection Vulnerability

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: runZero

Description
The root-privileged `wsserver` terminal-bridge daemon builds a shell command from client-supplied WebSocket fields and passes it to `system()` and `popen()` without quoting, escaping, or character-set validation. The daemon's public-key session path performs no appliance-session check.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-65184
EUVD
EUVD-2026-109933

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Vertiv Avocent ACS8000 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-65184 is a critical command injection flaw in the Avocent ACS8000 console server's wsserver daemon. The daemon runs as root and processes WebSocket fields from clients without proper sanitization. This allows unauthenticated attackers to inject and execute arbitrary commands on the system via the network-reachable terminal bridge interface.

Detection Guidance

Check for the presence of the Avocent ACS8000 console server on your network. Inspect running processes for the wsserver daemon using commands like 'ps aux | grep wsserver'. Review network traffic for WebSocket connections to the terminal bridge interface on port 443 or other exposed ports.

Impact Analysis

Exploitation could grant full control of the console server, including access to all connected serial consoles and managed devices. Attackers could execute arbitrary commands, potentially leading to system compromise, data theft, or disruption of connected equipment.

Mitigation Strategies

Isolate the Avocent ACS8000 console server from untrusted networks. Apply the latest firmware update from Vertiv if available. Disable the wsserver daemon if not required. Implement network-level access controls to restrict WebSocket traffic to trusted sources only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65184. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart