Cellopoint CelloOS CVE-2026-12059

Exploitation requires network reachability to the CelloOS SSH management service (typically TCP/22 on the appliance management interface) and valid credentials for a low-privileged operator account on the appliance - consistent with the CVSS PR:L metric. No user interaction is needed and no non-default configuration is required, since the restricted SSH command shell is the standard management surface on Cellopoint email security appliances. The principal limiting factor is the credential requirement plus the fact that, in well-segmented deployments, the SSH management port is firewalled off from untrusted networks; internet-exposed or flat-network appliances are at materially higher risk.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N) describes a network-reachable, low-complexity attack requiring only low-privileged credentials and no user interaction, with high impact to confidentiality, integrity, and availability of the vulnerable appliance - consistent with a restricted-shell escape leading to full OS command execution. The 8.7 score (High) is credible because management SSH on a security appliance is a high-value target and any valid operator account becomes a stepping stone to root-level appliance compromise. Mitigating factors are that PR:L means valid credentials are needed (so this is not an unauthenticated internet-spray scenario) and that SSH on Cellopoint appliances is normally restricted to management networks. EPSS is not provided, the CVE is not in CISA KEV, and no POC has been published, so this should currently be treated as a credible but not yet weaponized issue - prioritize patching but it is not a drop-everything emergency unless your appliance management interface is internet-exposed.

An attacker who has obtained a low-privileged operator credential for a Cellopoint email security gateway - for example via phishing of a sysadmin, credential reuse, or insider access - connects to the appliance's SSH management interface and lands in the restricted command shell. They submit a crafted command string that the parser fails to validate, causing the underlying OS shell to interpret it and execute arbitrary commands as the management user (and from there potentially escalate). The attacker can then read mail spools, exfiltrate quarantined content, tamper with anti-spam/AV policy, or pivot deeper into the network; no public POC has been identified at time of analysis.