What is the CVSS score of CVE-2026-27182?

CVE-2026-27182 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Saturn Remote Mouse Server are affected by CVE-2026-27182?

A critical remote code execution vulnerability in Saturn Remote Mouse Server (CVE-2026-27182) allows unauthenticated attackers to execute arbitrary commands on affected systems.

How to fix or mitigate CVE-2026-27182?

Within 24 hours: Identify all systems running Saturn Remote Mouse Server and isolate them from untrusted networks; block inbound UDP port 27000 at the firewall perimeter. Within 7 days: Conduct a threat hunt for indicators of compromise on affected systems; implement network segmentation to restrict access to port 27000 to authorized sources only. Within 30 days: Develop a plan to upgrade or replace Saturn Remote Mouse Server; evaluate alternative remote access solutions that receive active security updates.

Saturn Remote Mouse Server CVE-2026-27182

HIGH

Missing Authentication for Critical Function (CWE-306)

2026-02-18 disclosure@vulncheck.com

RCE Command Injection

8.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.4 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 18, 2026 - 22:16 nvd

HIGH 8.4

DescriptionCVE.org

Saturn Remote Mouse Server contains a command injection vulnerability that allows unauthenticated attackers to execute arbitrary commands by sending specially crafted UDP JSON frames to port 27000. Attackers on the local network can send malformed packets with unsanitized command data that the service forwards directly to OS execution functions, enabling remote code execution under the service account.

AnalysisAI

Saturn Remote Mouse Server on local networks is vulnerable to unauthenticated command injection through specially crafted UDP JSON packets sent to port 27000, enabling attackers to execute arbitrary code with service account privileges. Affected systems lack input validation on command parameters, allowing network-adjacent threat actors to achieve remote code execution without authentication. No patch is currently available for this high-severity vulnerability.

Technical ContextAI

Classified as CWE-306 (Missing Authentication for Critical Function). Saturn Remote Mouse Server contains a command injection vulnerability that allows unauthenticated attackers to execute arbitrary commands by sending specially crafted UDP JSON frames to port 27000. Attackers on the local network can send malformed packets with unsanitized command data that the service forwards directly to OS execution functions, enabling remote code execution under the service account.

Affected ProductsAI

Saturn Remote Mouse Server contains a command injection vulnerability that allows unauthenticated attackers to execute arbitrary commands by sending s