CVE-2026-15495
MediumCVSS 6.3Exploitation Probability (EPSS)
Elevated risk72th percentile - higher than 72% of all known CVEs
Summary
In the Android WebSocket Server component of sonic-agent up to version 2.7.2, a vulnerability allows OS command injection. The flaw resides in an unknown function of AndroidWSServer.java, where manipulation of the path argument enables remote command execution. The vendor did not respond, and the exploit has been publicly disclosed.
Risk Assessment
The organization faces remote system compromise, potentially leading to data theft, malware installation, or full integrity breach. As the product is end-of-life, no official patches are available.
Recommendation
Immediately stop using sonic-agent version 2.7.2 and earlier. Due to lack of vendor support, migrate to an alternative, actively maintained solution.
Related vulnerabilities
- CVE-2026-77524Critical
KEDA is a Kubernetes-based Event Driven Autoscaling component. In version 2.20.2 and earlier, a namespace administrator who can create TriggerAuthentication and ScaledObject resources can set hashiCorpVault.address to a tenant-controlled endpoint and select Kubernetes authentication without an explicit credential. KEDA then uses the operator pod's projected ServiceAccount token and sends it to that endpoint as a Vault login credential; the JWT-shape filter from the prior CVE-2025-68476 remediation accepts the operator token because its subject is a Kubernetes ServiceAccount, allowing the attacker to obtain the operator's cluster-wide permissions, including broad Secret reads and workload or admission-related operations.
- CVE-2026-76519CriticalActively exploited
A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. It is due to improper handling of email attachments when the file reputation service is enabled; an attacker could send an email with a crafted attachment through an affected device, potentially allowing arbitrary file writes and command execution with root privileges.
- CVE-2026-33796Critical
A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured external BGP neighbor to execute arbitrary commands with root privileges via BMP route monitoring.
- CVE-2026-33792Critical
A stack-based buffer overflow vulnerability in the srxpfe process of Juniper Networks Junos OS on SRX Series allows an unauthenticated network attacker to execute code as root or cause a denial of service via a crafted packet received on a configured GRE tunnel.
- CVE-2026-33789Critical
A stack-based buffer overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated BGP peer to cause a denial of service and potential root-level command execution via crafted BGP route updates when the BGP Monitoring Protocol (BMP) is enabled.
- CVE-2026-109439Critical
A missing authentication vulnerability in Lantronix XPress-DR and XPress-DR-I (CoBos-family) firmware through 8.1.0.0 allows remote attackers to read and persistently overwrite device configuration by sending crafted frames to the unauthenticated UDP configuration protocol on port 30718. Attackers can send a type 0xF8 query to read live configuration data and a type 0xFD frame with exactly 0x78 body bytes to rewrite the device IP address and serial-channel forwarding records, causing changes to commit to EEPROM and persist across reboots. The XPress-DR product series reached end-of-life/end-of-support in February 2025.
- CVE-2026-102182Critical
A stack-based buffer overflow vulnerability in the kmd component of Juniper Networks Junos OS on MX Series allows an unauthenticated network attacker to execute code as root via specific IKE certificate-based packets. This issue affects Junos OS on MX Series in versions before 21.2R3-S11, from 21.4 before 21.4R3-S12, from 22.2 before 22.2R3-S8, from 22.3 before 22.3R3-S5, and from 22.4 before 22.4R3-S9.
- CVE-2026-102178Critical
A stack-based buffer overflow vulnerability in the BGP routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP flowspec peer to cause routing-engine compromise or a routing-daemon denial of service via flowspec route re-advertisement when BGP update-threading is enabled.
- CVE-2026-102175Critical
A heap-based buffer overflow vulnerability in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated attacker who can control or intercept the configured SDX/SRC server connection to execute code as root or cause denial of service via a crafted frame received over the service-deployment TCP connection.
- CVE-2026-102031Critical
An OS command injection vulnerability in TACACS of Juniper Networks Junos OS Evolved allows a low-privileged TACACS+-authenticated user to execute commands with root privileges when periodic TACACS+ authorization-refresh is enabled.
Original NVD description (English source)
A vulnerability has been found in SonicCloudOrg sonic-agent up to 2.7.2. The affected element is an unknown function of the file AndroidWSServer.java of the component Android WebSocket Server. The manipulation of the argument path leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS