Which versions of H3C NX15 are affected by CVE-2026-18900?

H3C NX15 firmware V100R017 contains a remote command injection vulnerability in its management API that allows authenticated attackers to execute arbitrary OS commands; publicly available exploit…

Is there a public PoC exploit available for CVE-2026-18900?

Yes, a public proof-of-concept exploit is available for CVE-2026-18900. Prioritise patching immediately. EPSS: 2.4%.

How to fix or mitigate CVE-2026-18900?

Within 24 hours, identify and catalog all H3C NX15 V100R017 systems and implement firewall or WAF rules restricting access to the vulnerable /api/esps endpoint; require multi-factor authentication for administrative access to all affected devices. Within 7 days, deploy centralized logging for all /api/esps API calls with real-time alerting configured for anomalous patterns, validate network segmentation prevents lateral movement from compromised devices, and establish incident response procedures specific to this vulnerability. Within 30 days, execute firmware upgrades to the latest available H3C release, perform post-upgrade validation of patching effectiveness, and conduct a full security review of management API configurations across the deployment.

H3C NX15 CVE-2026-18900

Q: What is the CVSS score of CVE-2026-18900?

CVE-2026-18900 has a CVSS 4.0 base score of 7.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 2.4%.

EUVD-2026-53029 HIGH

OS Command Injection (CWE-78)

2026-08-05 VulDB

GHSA-4hjf-4f6f-fghm

Command Injection Nx15 H3C

7.3

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.2 HIGH

Network-accessible API exploitable only by an authenticated administrator (PR:H); no complexity or interaction required; full confidentiality, integrity, and availability impact with no scope change to other systems.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Aug 05, 2026 - 05:30 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 05, 2026 - 05:22 vuln.today

cvss_changed

CVSS changed

Aug 05, 2026 - 05:22 NVD

8.6 (HIGH) 7.3 (HIGH)

Analysis Generated

Aug 05, 2026 - 05:01 vuln.today

CVE Published

Aug 05, 2026 - 03:45 cve.org

HIGH 8.6

DescriptionCVE.org

A weakness has been identified in H3C NX15 V100R017. This impacts the function file.exec of the file /api/esps of the component Backend RPC. This manipulation of the argument File causes os command injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.

AnalysisAI

OS command injection in H3C NX15 firmware V100R017 enables authenticated remote attackers to execute arbitrary operating system commands by manipulating the File argument in the file.exec function exposed via the /api/esps Backend RPC endpoint. A public Python proof-of-concept exploit script is available on GitHub, substantially lowering the barrier to exploitation for less-skilled actors. No vendor-released patch has been identified at time of analysis, leaving affected deployments dependent on compensating controls.

Technical ContextAI

The H3C NX15 is an IoT/networking device (CPE: cpe:2.3:a:h3c:nx15:*:*:*:*:*:*:*:*) running embedded firmware version V100R017. The vulnerability is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command), meaning the Backend RPC handler for the /api/esps API endpoint passes attacker-controlled input from the File argument directly - or without adequate sanitization - into an OS-level shell execution context via the file.exec function. Embedded Linux-based networking devices of this class commonly execute such backend functions with root or highly privileged system accounts, meaning successful injection likely yields commands running at the highest privilege level. The RPC-style API design, typical of device management interfaces in this product family, exposes the vulnerable path over the network without requiring physical access.

RemediationAI

No vendor-released patch has been identified at time of analysis - the disclosure notes the vendor was contacted early, but no official fix version or H3C security advisory is available from the provided references. Monitor VulDB (https://vuldb.com/vuln/385934) and H3C's official security portal for patch releases. As immediate compensating controls: restrict network access to the /api/esps Backend RPC endpoint using host-based or perimeter firewall ACLs to permit only trusted management hosts - note this is ineffective if the attacker operates from within a trusted segment. Enforce strong, unique administrative credentials and disable default accounts to raise the effective cost of the PR:H prerequisite; credential hygiene is the single highest-value mitigation given the authentication dependency. If the device management interface does not need to be network-accessible, isolate affected devices on a dedicated out-of-band management VLAN. Monitor device logs for anomalous process execution or unexpected outbound connections as indicators of compromise.