Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    1 vulnerability

    CVE-2026-107510 (GCVE-0-2026-107510)

    Vulnerability from cvelistv5 – Published: 2026-10-08 09:45 – Updated: 2026-10-08 14:23
    VLAI
    Title
    Authenticated argument injection in NIOS command line leading to privilege escalation
    Summary
    An authenticated high privilege user can inject arguments in troubleshooting commands resulting in privilege escalation.
    Severity
    9.1 (Critical)
    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-10-08 14:22 UTC
    CWE
    • CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
    • CWE-284 - Improper Access Control
    • CWE-269 - Improper Privilege Management
    Assigner
    Infoblox CNA under the mitre root
    CNA scorecard – unranked: 1 record in the last 180 days, 10 needed details
    References
    Impacted products
    Vendor Product Version
    Infoblox NIOS Affected: 9.0.x , ≤ 9.1.0 (custom)
    		Create a notification for this product.
    Credits
    AUMLayer Cloud Labs LLP
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-107510",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-08T14:22:15.529369Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-88",
                "description": "CWE-88 Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              },
              {
                "cweId": "CWE-284",
                "description": "CWE-284 Improper Access Control",
                "lang": "en",
                "type": "CWE"
              },
              {
                "cweId": "CWE-269",
                "description": "CWE-269 Improper Privilege Management",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-08T14:23:38.757Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "NIOS",
          "vendor": "Infoblox",
          "versions": [
            {
              "lessThanOrEqual": "9.1.0",
              "status": "affected",
              "version": "9.0.x",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "AUMLayer Cloud Labs LLP"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An authenticated high privilege user can inject arguments in troubleshooting commands resulting in privilege escalation."
            }
          ],
          "value": "An authenticated high privilege user can inject arguments in troubleshooting commands resulting in privilege escalation."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-233",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-233 Privilege Escalation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T09:47:26.352Z",
        "orgId": "f84ca5ce-fbe7-4668-8724-994599108a02",
        "shortName": "Infoblox"
      },
      "references": [
        {
          "url": "https://support.infoblox.com/s/article/Security-Advisory-NIOS-Maintenance-Mode-Permits-Root-Shell"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Authenticated argument injection in NIOS command line leading to privilege escalation",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f84ca5ce-fbe7-4668-8724-994599108a02",
    "assignerShortName": "Infoblox",
    "cveId": "CVE-2026-107510",
    "datePublished": "2026-10-08T09:45:04.001Z",
    "dateReserved": "2026-10-08T09:40:34.058Z",
    "dateUpdated": "2026-10-08T14:23:38.757Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}