CVE-2026-15496

MediumCVSS 6.3

Published: 12/07/2026(UTC)Updated: 13/07/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.16%

63th percentile - higher than 63% of all known CVEs

Summary

In SonicCloudOrg sonic-agent up to version 2.7.2, a vulnerability was found in the evalIsFailed function in GroovyScriptImpl.java allowing OS command injection. The attack can be launched remotely and the exploit has been made public. The product is no longer supported by the vendor.

Risk Assessment

The organization is at risk of remote system takeover via arbitrary OS command execution, potentially leading to full server compromise and data breach.

Recommendation

Immediately stop using sonic-agent version 2.7.2 and older. Since the vendor does not provide support, consider migrating to an alternative solution or applying temporary WAF rules to block suspicious requests.

Other vulnerabilities in SonicCloudOrg sonic-agent

CVE-2026-15497High
A remote code injection vulnerability was found in SonicCloudOrg sonic-agent up to version 2.7.2 within the JWT Authentication Filter component. The flaw resides in ExchangeController.java and can be exploited remotely. The exploit is publicly disclosed and the product is no longer supported.

Original NVD description (English source)

A vulnerability was found in SonicCloudOrg sonic-agent up to 2.7.2. The impacted element is the function evalIsFailed of the file sonic-agent/src/main/java/org/cloud/sonic/agent/tests/script/GroovyScriptImpl.java of the component Groovy Script Handler. The manipulation results in os command injection. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.