Is there a public PoC exploit available for CVE-2026-18993?

Yes, a public proof-of-concept exploit is available for CVE-2026-18993. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for CVE-2026-18993?

Yes, a patch is available for CVE-2026-18993. Update the affected software to the latest version immediately.

hermes-agent CVE-2026-18993

Q: What is the CVSS score of CVE-2026-18993?

CVE-2026-18993 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-53706 LOW

Improper Access Control (CWE-284)

2026-08-06 VulDB

GHSA-4992-66px-gwh3

Authentication Bypass Hermes Agent

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Network-exploitable with no special conditions, but PR:L required per CVSS 4.0 signal; low impacts across all dimensions with no scope change beyond the vulnerable system.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Aug 06, 2026 - 05:22 NVD

MEDIUM LOW

CVSS changed

Aug 06, 2026 - 05:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Source Code Evidence Fetched

Aug 06, 2026 - 04:48 vuln.today

Analysis Generated

Aug 06, 2026 - 04:48 vuln.today

CVE Published

Aug 06, 2026 - 03:45 cve.org

MEDIUM 5.3

DescriptionCVE.org

A vulnerability was detected in NousResearch hermes-agent up to 0.16.0. Affected by this issue is some unknown functionality of the file hermes-agent/model_tools.py of the component Memory Toolset. The manipulation results in improper access controls. The attack can be executed remotely. The exploit is now public and may be used.

AnalysisAI

Improper access control in NousResearch hermes-agent up to 0.16.0 allows low-privileged authenticated users to invoke the Memory Toolset even when it has been explicitly disabled by an operator via the disabled_toolsets configuration. The root cause is a missing guard in init_agent() within agent/agent_init.py, which unconditionally injected the Memory Toolset regardless of operator-level restrictions. A public proof-of-concept exploit exists (GitHub issue #48181), and a vendor patch is available via pull request #46185.

Technical ContextAI

hermes-agent is an AI agent orchestration framework by NousResearch (CPE: cpe:2.3:a:nousresearch:hermes-agent:*:*:*:*:*:*:*:*). The vulnerable component is the Memory Toolset, implemented in hermes-agent/model_tools.py and injected during agent initialization in agent/agent_init.py. The root cause class is CWE-284 (Improper Access Control): the init_agent() function failed to check whether disabled_toolsets contained the string 'memory' before injecting the Memory Toolset into the agent session. The patch (PR #46185) adds the guard and not (agent.disabled_toolsets and 'memory' in agent.disabled_toolsets) to enforce operator-level toolset suppression. This type of flaw is characteristic of authorization logic that enforces restrictions at configuration time but fails to propagate those restrictions into initialization pathways.

RemediationAI

The upstream fix is available in GitHub Pull Request #46185 (https://github.com/NousResearch/hermes-agent/pull/46185), which patches agent/agent_init.py to skip Memory Toolset injection when 'memory' appears in agent.disabled_toolsets. A specific tagged patched release version has not been confirmed from available data - only the upstream PR exists. Operators should pull the latest commit from the main branch or apply the patch from PR #46185 directly. As a compensating control prior to patching, operators can restrict network access to the hermes-agent API to only fully trusted, low-risk authenticated users, reducing the pool of principals capable of exploiting the bypass. Restricting which users can create agent sessions is a secondary mitigation with no functional side effects for legitimate workflows.