What is the CVSS score of CVE-2026-35847?

CVE-2026-35847 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of dnsmgr are affected by CVE-2026-35847?

dnsmgr versions 2.15 and earlier contain a critical command injection vulnerability in the ping function that enables remote code execution.

How to fix or mitigate CVE-2026-35847?

Within 24 hours: Conduct an asset inventory to identify all systems running dnsmgr 2.15 or earlier and assess their network exposure and operational criticality. Activate emergency change control procedures and verify incident response team readiness. Within 7 days: Deploy firewall rules to restrict dnsmgr access to only authorized networks; implement Web Application Firewall (WAF) or Intrusion Detection System (IDS) signatures to detect and block command injection attempts targeting the ping function; disable the ping function in dnsmgr if business operations permit. Within 30 days: Request patch availability and timeline from dnsmgr vendor; evaluate and prepare migration to alternative DNS management solutions; if no patch is available, execute contingency plans including system air-gapping or controlled decommissioning while ensuring DNS services continue through alternatives.

dnsmgr CVE-2026-35847

EUVD-2026-51328 CRITICAL

Command Injection (CWE-77)

2026-07-30 mitre

GHSA-2cgh-c72w-rfjm

RCE Command Injection PHP N A

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Command injection over the network yields total system impact (C/I/A:H) with low complexity, but the ping feature is an admin panel function so authenticated access is realistically required (PR:L).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 20:30 vuln.today

CVSS changed

Jul 31, 2026 - 18:37 NVD

9.8 (CRITICAL)

CVE Published

Jul 30, 2026 - 00:00 cve.org

CRITICAL 9.8

CVE Published

Jul 30, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

An issue in dnsmgr v.2.15 and before allows a local attacker to execute arbitrary code via the ping function of the CheckUils.php file

AnalysisAI

OS command injection in dnsmgr version 2.15 and earlier lets an attacker execute arbitrary commands through the ping function in CheckUils.php, which passes unsanitized input into a system shell call (CWE-77). SSVC rates the technical impact as total and marks exploitation as proof-of-concept, so publicly available exploit code exists, though it is not on CISA KEV and EPSS is low (0.15%). The published CVSS is 9.8, but note the description characterizes the attacker as 'local' while the CVSS vector encodes AV:N - this discrepancy affects real-world exposure and should be resolved against the target deployment.

Technical ContextAI

dnsmgr is a PHP-based DNS management panel (Chinese-origin web control panel for managing DNS records/servers). The flaw is a classic OS command injection (CWE-77) in a diagnostic 'ping' feature implemented in CheckUils.php: user-supplied input (presumably a hostname/IP to ping) is concatenated into a shell command without sanitization, so shell metacharacters (e.g. ;, |, `, &&, $()) let the attacker append arbitrary commands that run with the privileges of the PHP/web process. This is the canonical anti-pattern where a network diagnostic wrapper invokes the underlying OS ping binary via a shell. CPE data is uninformative here - the NVD CPE is a placeholder (cpe:2.3:a:n/a:n/a:*), so exact product identification rests on the CVE description naming dnsmgr and the tags (RCE, PHP, Command Injection).

RemediationAI

No vendor-released patch or fixed version is identified in the available data, so a specific upgrade target cannot be cited - monitor the dnsmgr project for a release newer than 2.15 that addresses CheckUils.php. As compensating controls: restrict network access to the dnsmgr management panel to trusted admin IPs via firewall/ACL or place it behind a VPN, since the ping feature is an administrative diagnostic; if the ping/network-check feature is not required, disable or remove the CheckUils.php ping endpoint (trade-off: loss of in-panel connectivity diagnostics); enforce strong authentication and, where possible, a WAF rule blocking shell metacharacters (;, |, &, `, $(, newline) in the ping parameter (trade-off: WAF filtering can be bypassed and may break legitimate hostnames). Consult the NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-35847) and VulDB (https://vuldb.com/vuln/384944) entries for updates, and review the referenced GitHub PoC (https://github.com/freedom2132/CVE) to build detection for exploitation attempts against the ping parameter.