WebUI. If CVE-2026-59764

Q: What is the CVSS score of CVE-2026-59764?

CVE-2026-59764 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.1%.

EUVD-2026-49725 HIGH

OS Command Injection (CWE-78)

2026-07-28 vultures@jpcert.or.jp

GHSA-5rfp-gm74-mxcc

Command Injection

8.6

CVSS 4.0 · Vendor: jpcert

Severity by source

Vendor (jpcert) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (jpcert) · only source for this CVE.

CVSS VectorVendor: jpcert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 09:32 vuln.today

CVE Published

Jul 28, 2026 - 09:16 cve.org

HIGH 8.6

DescriptionCVE.org

ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability in WebUI. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.

AnalysisAI

Authenticated OS command injection in ELECOM wireless LAN routers and access points allows an attacker with administrative credentials to execute arbitrary operating system commands on the device. Exploitation requires logging into the product's WebUI; no public exploit or active exploitation has been reported at this time. The vulnerability is confirmed by the vendor and JPCERT/CC, with a CVSS 4.0 score of 8.6 (High).