Which versions of PHP are affected by CVE-2026-4170?

A critical remote code execution vulnerability (CVE-2026-4170, CVSS 9.8) has been identified in Topsec TopACM 3.0 with public exploit code available and no vendor patch.

Is there a public PoC exploit available for CVE-2026-4170?

Yes, a public proof-of-concept exploit is available for CVE-2026-4170. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-4170?

Within 24 hours: Isolate all TopACM 3.0 instances from production networks or restrict network access to trusted sources only; confirm inventory of affected systems; establish incident response readiness. Within 7 days: Deploy WAF rules or intrusion prevention signatures to block exploitation attempts on the nmc_sync.php parameter; implement enhanced monitoring and logging; assess feasibility of product replacement or emergency upgrade. Within 30 days: Execute long-term remediation strategy—either migrate to patched/alternative solutions, or decommission the affected TopACM 3.0 deployment; conduct forensic analysis for indicators of compromise.

PHP CVE-2026-4170

Q: What is the CVSS score of CVE-2026-4170?

CVE-2026-4170 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-12214 HIGH

OS Command Injection (CWE-78)

2026-03-15 VulDB

Command Injection PHP

8.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Severity Changed

Apr 22, 2026 - 21:37 NVD

CRITICAL HIGH

CVSS changed

Apr 22, 2026 - 21:37 NVD

9.8 (CRITICAL) 8.9 (HIGH)

PoC Detected

Mar 16, 2026 - 14:53 vuln.today

Public exploit code

EUVD ID Assigned

Mar 15, 2026 - 09:00 euvd

EUVD-2026-12214

Analysis Generated

Mar 15, 2026 - 09:00 vuln.today

CVE Published

Mar 15, 2026 - 07:02 nvd

CRITICAL 9.8

DescriptionCVE.org

A weakness has been identified in Topsec TopACM 3.0. Affected by this vulnerability is an unknown functionality of the file /view/systemConfig/management/nmc_sync.php of the component HTTP Request Handler. Executing a manipulation of the argument template_path can lead to os command injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Critical OS command injection vulnerability in Topsec TopACM 3.0's web management interface that allows unauthenticated remote attackers to execute arbitrary system commands. A public proof-of-concept exploit is available, and the vulnerability has a CVSS score of 9.8, though no active exploitation has been confirmed in CISA's KEV catalog. The vendor has not responded to disclosure attempts, leaving systems unpatched.

Technical ContextAI

The vulnerability affects Topsec TopACM (cpe:2.3:a:topsec:topacm:*:*:*:*:*:*:*:*), specifically in the file /view/systemConfig/management/nmc_sync.php which handles HTTP requests. The root cause is CWE-78 (OS Command Injection), where user-supplied input to the 'template_path' parameter is not properly sanitized before being passed to system execution functions. This is a classic PHP command injection vulnerability where attacker-controlled data flows into dangerous functions like system(), exec(), or shell_exec() without validation.

RemediationAI

No patch is currently available as the vendor did not respond to disclosure attempts. Immediate mitigations include: 1) Block external access to the TopACM management interface using firewall rules, 2) Implement web application firewall (WAF) rules to filter malicious payloads targeting the template_path parameter, 3) Consider disabling the affected nmc_sync.php functionality if not required, 4) Monitor system logs for suspicious command execution from the web server process. Given the lack of vendor response, organizations should consider alternative access control solutions if possible.