Which versions of H3C NX15 are affected by CVE-2026-18811?

H3C NX15 V100R017 management systems contain a command injection vulnerability in the /api/esps endpoint that allows authenticated high-privilege users to execute arbitrary OS commands as root.

Is there a public PoC exploit available for CVE-2026-18811?

Yes, a public proof-of-concept exploit is available for CVE-2026-18811. Prioritise patching immediately. EPSS: 2.3%.

How to fix or mitigate CVE-2026-18811?

Within 24 hours: conduct an inventory of all H3C NX15 V100R017 deployments and restrict network access to the /api/esps endpoint to authorized management stations only; implement strict network segmentation isolating management interfaces from general network access. Within 7 days: deploy Web Application Firewall (WAF) rules to block requests to /api/esps containing command injection patterns, enable enhanced logging and alerting on all API calls to this endpoint, and audit all high-privilege account activity for suspicious API access. Within 30 days: coordinate with H3C to obtain confirmed patch timeline and ETA, evaluate feasibility of upgrading to patched H3C NX15 versions, and implement intrusion detection signatures specific to CWE-77 injection patterns targeting this endpoint.

H3C NX15 CVE-2026-18811

Q: What is the CVSS score of CVE-2026-18811?

CVE-2026-18811 has a CVSS 4.0 base score of 7.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 2.3%.

EUVD-2026-52896 HIGH

Command Injection (CWE-77)

2026-08-04 VulDB

GHSA-rqmq-f79h-845j

Command Injection Nx15 H3C

7.3

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.2 HIGH

Administrative credentials required (PR:H), network-reachable API with no complexity or interaction needed; full device compromise with no scope change (S:U, C/I/A:H).

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Aug 04, 2026 - 21:30 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 04, 2026 - 21:22 vuln.today

cvss_changed

CVSS changed

Aug 04, 2026 - 21:22 NVD

8.6 (HIGH) 7.3 (HIGH)

Analysis Generated

Aug 04, 2026 - 21:00 vuln.today

CVE Published

Aug 04, 2026 - 20:15 cve.org

HIGH 8.6

DescriptionCVE.org

A vulnerability was detected in H3C NX15 V100R017. The affected element is the function Add of the file /api/esps. Performing a manipulation of the argument esps.filter.url results in command injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure.

AnalysisAI

Command injection in H3C NX15 V100R017 allows authenticated remote attackers to execute arbitrary OS commands as root via the /api/esps management endpoint. The vulnerability exists in the Add function's handling of the esps.filter.url parameter, which is passed unsanitized to a system command (CWE-77). A public proof-of-concept exploit demonstrating root-level remote code execution is available on GitHub, elevating real-world risk beyond the theoretical - though exploitation requires high-privilege credentials, and no confirmed active exploitation (CISA KEV) has been identified at time of analysis.

Technical ContextAI

The H3C NX15 is a network appliance running firmware version V100R017, identified by CPE string cpe:2.3:a:h3c:nx15:*:*:*:*:*:*:*:*. The affected code path is the Add function within the /api/esps REST API endpoint, which processes filter rules that include a URL parameter (esps.filter.url). CWE-77 (Improper Neutralization of Special Elements used in a Command) indicates the root cause: the URL string supplied by the caller is concatenated or interpolated into a shell command without adequate sanitization or escaping of metacharacters. The PoC repository on GitHub is explicitly named 'esps_filter_url_add_root_rce', confirming that the injected commands execute in the context of the root user, consistent with how many embedded network device management daemons operate.

RemediationAI

No vendor-released patch has been identified at time of analysis - H3C should be contacted directly regarding a firmware update for NX15 V100R017. As immediate compensating controls: restrict network access to the device management API (particularly /api/esps) using ACLs or firewall rules so only trusted management hosts on a dedicated out-of-band network can reach it - this directly counters the AV:N vector and eliminates remote exploitation for most threat actors. If remote management is not operationally required, disable it entirely. Rotate any administrative credentials that may have been exposed or are shared across devices, since the PR:H prerequisite means credential compromise is the enabling condition. Monitor API request logs for anomalous parameter values in esps.filter.url containing shell metacharacters (semicolons, backticks, pipes, dollar signs). The public PoC at https://github.com/coconut652-7/IOT_Vul_Public/tree/main/H3C/NX15R017/esps_filter_url_add_root_rce can be used to validate whether deployed compensating controls are effective in a lab environment.