Is there a public PoC exploit available for CVE-2026-15496?

Yes, a public proof-of-concept exploit is available for CVE-2026-15496. Prioritise patching immediately. EPSS: 1.2%.

sonic-agent CVE-2026-15496

Q: What is the CVSS score of CVE-2026-15496?

CVE-2026-15496 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.2%.

EUVD-2026-43218 LOW

OS Command Injection (CWE-78)

2026-07-12 VulDB

GHSA-4896-cr5v-422q

Java Command Injection Sonic Agent Soniccloudorg

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.9 CRITICAL

PR:L per CVSS 4.0 data; S:C and C/I/A:H reflect unsandboxed Groovy RCE enabling full host OS command execution beyond the application scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 12, 2026 - 11:33 vuln.today

Severity Changed

Jul 12, 2026 - 11:22 NVD

MEDIUM LOW

CVSS changed

Jul 12, 2026 - 11:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A vulnerability was found in SonicCloudOrg sonic-agent up to 2.7.2. The impacted element is the function evalIsFailed of the file sonic-agent/src/main/java/org/cloud/sonic/agent/tests/script/GroovyScriptImpl.java of the component Groovy Script Handler. The manipulation results in os command injection. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

AnalysisAI

OS command injection in SonicCloudOrg sonic-agent up to version 2.7.2 allows remote low-privileged attackers to execute arbitrary system commands via the evalIsFailed function in the Groovy Script Handler component. The public proof-of-concept - titled 'Unsandboxed_RCE' - confirms that Groovy scripts are executed without a security sandbox, enabling full host-level command execution. Critically, this is an end-of-life product with no vendor response and no patch, meaning no fix is forthcoming; no public exploit identified in CISA KEV at time of analysis, but a public POC exists.

Technical ContextAI

sonic-agent is a Java-based test automation agent component of the SonicCloudOrg platform. The vulnerability resides in the evalIsFailed function within GroovyScriptImpl.java (org.cloud.sonic.agent.tests.script package), which evaluates Groovy scripts as part of test result logic. Groovy, a JVM-compatible scripting language, provides access to Java runtime internals and OS-level APIs (e.g., Runtime.exec(), ProcessBuilder). CWE-78 (Improper Neutralization of Special Elements used in an OS Command) applies: unsanitized user-controlled input is passed into a Groovy evaluation context that has direct shell execution capability. The CPE cpe:2.3:a:soniccloudorg:sonic-agent:*:*:*:*:*:*:*:* covers all versions through 2.7.2. The POC repository name ('Unsandboxed_RCE') confirms the Groovy engine runs without a SecurityManager or sandboxing constraints, making script-level injection equivalent to direct OS code execution.

RemediationAI

No vendor-released patch is available and none is expected, as the vendor did not respond to disclosure and the product is end-of-life. The primary remediation is migration away from sonic-agent 2.7.2 or earlier to an actively maintained alternative. For teams unable to migrate immediately, compensating controls should include: restricting network access to the sonic-agent API surface via firewall rules or VPN so that only trusted internal hosts can reach the service (this reduces AV:N to AV:L in practice); enforcing strict least-privilege access so that the low-privilege accounts capable of submitting Groovy scripts are limited to verified automation users; and disabling or blocking the Groovy script evaluation endpoint entirely if the evalIsFailed functionality is not operationally required. Note that disabling the Groovy handler may impact test result evaluation pipelines. Reference the POC at https://github.com/xpp3901/CVE_APPLY/tree/main/V-S002_SonicCloudPlatform_Groovy_Unsandboxed_RCE and VulDB advisory https://vuldb.com/vuln/377803 for technical details to inform isolation decisions.