Which versions of H3C NX15 are affected by CVE-2026-18814?

H3C NX15 network devices running firmware V100R017 contain a command injection vulnerability permitting authenticated users to execute arbitrary operating system commands with root privileges via the…

Is there a public PoC exploit available for CVE-2026-18814?

Yes, a public proof-of-concept exploit is available for CVE-2026-18814. Prioritise patching immediately. EPSS: 2.7%.

How to fix or mitigate CVE-2026-18814?

Within 24 hours: Inventory all H3C NX15 devices to identify systems running firmware V100R017; assess network exposure of affected devices and immediately restrict /api/esps endpoint access to trusted internal administrative networks only. Within 7 days: Implement network segmentation to isolate affected H3C NX15 devices, enforce strict firewall rules limiting API endpoint access to authorized administrators, and enable comprehensive logging of all API endpoint activity. Within 30 days: Contact H3C to determine firmware V100R018 or later availability; test the upgrade in a staging environment using a non-production device; execute a phased firmware rollout prioritizing Internet-facing and externally-accessible devices first.

H3C NX15 CVE-2026-18814

Q: What is the CVSS score of CVE-2026-18814?

CVE-2026-18814 has a CVSS 4.0 base score of 7.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 2.7%.

EUVD-2026-52930 HIGH

Command Injection (CWE-77)

2026-08-04 VulDB

GHSA-7x3v-6rjw-2262

Command Injection Nx15 H3C

7.3

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.2 HIGH

Network-accessible API (AV:N), low complexity, but admin authentication required (PR:H); full CIA impact on the device with no scope change.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 00:09 vuln.today

CVSS changed

Aug 04, 2026 - 22:22 NVD

8.6 (HIGH) 7.3 (HIGH)

CVE Published

Aug 04, 2026 - 21:15 cve.org

HIGH 7.3

DescriptionCVE.org

A vulnerability was found in H3C NX15 V100R017. This impacts the function reload.reload_config of the file /api/esps. The manipulation results in command injection. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.

AnalysisAI

Command injection in H3C NX15 firmware V100R017 permits network-accessible, authenticated attackers to execute arbitrary operating system commands via the /api/esps API endpoint by manipulating the reload.reload_config function parameter. The vulnerability, classified as CWE-77 (Command Injection), carries a CVSS 4.0 score of 7.3 and affects this specific H3C networking device firmware version. A public proof-of-concept exploit - titled 'service_add_root_rce' - has been published to GitHub, indicating root-level code execution is achievable; no vendor patch has been identified at time of analysis.

Technical ContextAI

The H3C NX15 is a networking appliance (CPE: cpe:2.3:a:h3c:nx15:*:*:*:*:*:*:*:*) running firmware V100R017. The vulnerable endpoint is /api/esps, which exposes the reload.reload_config function over HTTP/HTTPS. CWE-77 (Improper Neutralization of Special Elements used in a Command) indicates that user-supplied input passed to this function is not properly sanitized before being executed as part of a system-level command - a classic OS command injection pattern. The GitHub POC repository name 'service_add_root_rce' strongly implies the injected commands execute in a root or privileged process context, consistent with the CVSS 4.0 impact metrics of VC:H/VI:H/VA:H on the vulnerable system. No scope change to subsequent systems (SC:N/SI:N/SA:N) is indicated.

RemediationAI

No vendor-released patch has been identified at time of analysis. H3C was contacted prior to disclosure according to the VulDB report (https://vuldb.com/cve/CVE-2026-18814), but no official advisory or fixed firmware version has been published. As a compensating control, restrict access to the /api/esps endpoint at the network perimeter - block or firewall management API ports so the device's administrative interface is not reachable from untrusted networks, accepting the trade-off of reduced remote management capability. Additionally, enforce strong, unique admin passwords to eliminate credential-reuse attack paths, and disable remote management entirely if not operationally required. Monitor for unusual API calls to /api/esps and audit authentication logs for unauthorized admin logins. Check https://vuldb.com/vuln/385813 and H3C's official security advisories for firmware updates as they become available.