Secuno
ENNL
Book demo

CVE-2026-76862

8.8 HIGHEPSS 0.41%
  1. Published15 Sept 2026

Description

Netcore NR255-V version 1.5.130703 contains an os command argument injection vulnerability in the Nettools tcpdump launch paths, including ntools_start_set_cgi, ntools_tcpdump_start_set_cgi, exe_default, and ntools_proc components. Attackers can inject crafted arguments into these tcpdump launch routines to manipulate executed system commands on the device.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredLow
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-890368.8
Appwrite before 2.0.0 contains an argument injection vulnerability that allows…
CVE-2026-868648.8
pgAdmin 4's Backup tool appended the client-supplied 'database' field from the…
CVE-2026-543379.8
Fireshare facilitates self-hosted media and link sharing. Prior to version 1.6.14, an…
CVE-2026-877948.4
bestzip versions 2.2.6 and 3.0.2 contain an argument injection vulnerability in the…
CVE-2026-713779.8
Command Argument Injection Vulnerability in Cosminexus Component Container. This issue…
CVE-2026-860609.8
RouterOS contains an argument-handling flaw in the SSH login path involving usernames…

Frequently asked

Is CVE-2026-76862 being actively exploited?

CVE-2026-76862 is not in the CISA KEV catalog. Its EPSS exploit probability is 0.41%.

How severe is CVE-2026-76862?

CVE-2026-76862 has a CVSS 3.1 base score of 8.8, rated high. EPSS estimates a 0.41% probability of exploitation.

How do I fix CVE-2026-76862?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-76862 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.