CVE-2026-95707

HighCVSS 7.2/10Last modified Oct 24, 2026

Description

A buffer overflow vulnerability in the PAPI protocol of AOS-8 could allow an authenticated remote attacker with high privileges to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 22, 2026
Last modified
Oct 24, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-957087.2Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an authenticated remote attacker with high privCVE-2026-957097.2Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an authenticated remote attacker with high privCVE-2026-95716.5Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to invalidate OAuth refresh tokens upon user account deactiCVE-2026-957107.1An unauthenticated buffer overflow vulnerability exists in the underlying operating system of AOS-10 or AOS-8 and could allow an unauthenticCVE-2026-957117.1An authentication bypass vulnerability in the web-based management interface of AOS-10 could allow an unauthenticated adjacent attacker to cCVE-2026-957127.1A sensitive information disclosure vulnerability in the PAPI protocol of AOS-8 could allow an unauthenticated adjacent attacker to access liCVE-2026-957137.0An unauthenticated buffer overflow vulnerability exists in the command line interface of AOS-8. Successful exploitation could allow an unautCVE-2026-957146.8A buffer overflow vulnerability exists in the API of AOS-10 that could allow an authenticated adjacent attacker with high privileges to achiCVE-2026-957156.8An unauthenticated command injection vulnerability exists in the command line interface of AOS-10. Successful exploitation could allow an atCVE-2026-957166.5An authentication bypass in the PAPI protocol of AOS-10 allows an unauthenticated adjacent attacker to circumvent existing authentication coCVE-2026-957175.5A stored cross-site scripting (XSS) vulnerability exists in the web-based management interface of AOS that could allow an authenticated remoCVE-2026-957185.3An authentication bypass vulnerability in the PAPI protocol of AOS-8 could allow an unauthenticated remote attacker to circumvent existing a