CVE-2026-103056
CRITICAL
CVSS 9.0
Published: 2026-09-30
Modified: 2026-09-30
Tenable Plugin
Checking the public Tenable catalog…
Threat Intelligence Pending
IOCs, MITRE ATT&CK techniques, and attack chain data are being generated. Refresh in a few seconds.
Description
AiSOC versions 7.2.0 before 12.0.0 contain a command injection vulnerability in the actions service that builds CrowdStrike Real Time Response command strings by interpolating unescaped action parameters in crowdstrike_rtr.py and endpoint.py. Authenticated users can inject single quotes into file_path, path, script_name, or script_args parameters to break out of quoted arguments and execute arbitrary commands on managed endpoints with SYSTEM or root privileges.
Quick Facts
| CVE ID | CVE-2026-103056 |
| CVSS Score | 9.0 |
| Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H |
| Published | 2026-09-30 |
| Exploited | No |
| CISA KEV | No |
| PoC | Not public |
References
- https://github.com/beenuar/AiSOC/blob/v11.2.0/services/actio…
- https://github.com/beenuar/AiSOC/blob/v11.2.0/services/actio…
- https://github.com/beenuar/AiSOC/commit/dac39723404130312dab…
- https://github.com/beenuar/AiSOC/releases/tag/v12.0.0
- https://github.com/beenuar/AiSOC/security/advisories/GHSA-7q…
- https://www.vulncheck.com/advisories/aisoc-7.2.0-before-12.0…
- https://github.com/beenuar/AiSOC/security/advisories/GHSA-7q…