CVE-2026-68502

CriticalCVSS 9.8/10Last modified Oct 23, 2026

Description

LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn's lazyc2.py registers an unauthenticated Socket.IO input event handler that dispatches data.get('value') to LazyOwnShell.one_cmd, reaching LazyOwnShell.do_cmd and subprocess.call(command, shell=True), allowing unauthenticated remote code execution in the C2 process. This issue is fixed in 0.2.154.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published
Jul 30, 2026
Last modified
Oct 23, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-685039.8LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn ships default C2 credentials CVE-2026-685087.8Hydra is a framework for elegantly configuring complex applications. Prior to 1.3.4, hydra.utils.instantiate() resolves and calls Python objCVE-2026-68517.0An Improper link resolution before file access ('link following') vulnerability in the File Shredder module as used in Bitdefender Total SecCVE-2026-685137.1OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions 3.3CVE-2026-685145.5OpenEXR is the reference implementation and specification for the EXR image file format, widely used in the motion picture industry. In versCVE-2026-685157.1OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions CVE-2026-685166.5OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. From versionCVE-2026-685176.5Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, the cors_origins guard in glances/outputs/glances_restful_aCVE-2026-685188.8Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, _sanitize_mustache_dict() in glances/actions.py sanitizes iCVE-2026-685197.1Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, GlancesActions.run() in glances/actions.py ignores --disablCVE-2026-685205.3Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, as_dict_secure() in glances/config.py checks only option naCVE-2026-685237.5`fulgur` converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.19