What is the CVSS score of CVE-2026-27476?

CVE-2026-27476 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

How to fix or mitigate CVE-2026-27476?

Within 24 hours: Identify and inventory all RustFly 2.0.0 instances across infrastructure; isolate systems running this version from production networks where feasible. Within 7 days: Implement UDP port 5005 network segmentation/filtering at perimeter and internal firewalls to restrict access to trusted administrative sources only; enable enhanced monitoring and logging on affected systems for command injection attempts. Within 30 days: Evaluate alternative solutions or vendor communication on patch timeline; plan for system upgrade/replacement if patch remains unavailable.

CVE-2026-27476

CRITICAL

OS Command Injection (CWE-78)

2026-02-19 disclosure@vulncheck.com

Command Injection

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:03 vuln.today

CVE Published

Feb 19, 2026 - 21:18 nvd

CRITICAL 9.8

DescriptionCVE.org

RustFly 2.0.0 contains a command injection vulnerability in its remote UI control mechanism that accepts hex-encoded instructions over UDP port 5005 without proper sanitization. Attackers can send crafted hex-encoded payloads containing system commands to execute arbitrary operations on the target system, including reverse shell establishment and command execution.

AnalysisAI

Command injection in RustFly 2.0.0 via hex-encoded UDP instructions on port 5005. The remote UI control mechanism accepts and executes commands without validation.