SECURITYCRITICALCVE-2026-65184

CVE-2026-65184 — Root wsserver Daemon Command Injection (CVSS 9.8)

A root-privileged wsserver terminal-bridge daemon passes unsanitized WebSocket fields to system() and popen(), enabling unauthenticated command execution.

Dylan H.

Security Team

October 27, 2026
2 min read
CVE-2026-65184 — Root wsserver Daemon Command Injection (CVSS 9.8)

Critical severity

Rated critical. Prioritise patching — see the remediation guidance below.

Affected Products

  • Appliances running the vulnerable wsserver terminal-bridge daemon (vendor and versions not named in the NVD summary)

Executive Summary

CVE-2026-65184 is a critical command injection vulnerability (CVSS 9.8) published to the National Vulnerability Database on October 26, 2026. It affects the wsserver terminal-bridge daemon, which runs with root privileges.

The daemon builds a shell command from client-supplied WebSocket fields and passes it to system() and popen() without quoting, escaping, or character-set validation. Its public-key session path also performs no appliance-session check, so the injection point can be reached without a valid logged-in session.

The NVD summary available at the time of writing does not name the vendor, product, or affected version range. Check your appliance vendor's advisory before concluding whether you are exposed.

Vulnerability Overview

FieldDetail
CVECVE-2026-65184
CVSS9.8 (Critical)
Componentwsserver terminal-bridge daemon
Privilegeroot
WeaknessOS command injection (unsanitized input to system() / popen())
AuthenticationMissing appliance-session check on the public-key session path
Published2026-10-26

How it works

  1. A client opens a WebSocket connection to the terminal-bridge service.
  2. Fields supplied by the client are concatenated into a shell command string.
  3. The string is handed to system() or popen() with no escaping or validation.
  4. Shell metacharacters in those fields are interpreted by the shell, running attacker-chosen commands as root.

Because the public-key session path skips the appliance-session check, the attacker does not need prior credentials on the device.

Impact

  • Remote command execution as root on the appliance
  • Full device compromise, including configuration and credential theft
  • Pivoting into management networks from a trusted device

Recommended Actions

  1. Identify which devices in your environment run a wsserver terminal-bridge component and watch for the vendor advisory tied to this CVE.
  2. Restrict access to the management and WebSocket interfaces to a dedicated management network or VPN until a fix is applied.
  3. Apply the vendor patch as soon as one is released.
  4. Hunt for unexpected child processes of wsserver and for WebSocket requests containing shell metacharacters such as ;, |, backticks, and $(.
  5. Block internet exposure of the service at the perimeter firewall.

References