Which versions of ClearOS are affected by CVE-2026-67599?

Any organization operating ClearOS 7.9 infrastructure is exposed to complete system compromise through a readily-exploitable command injection vulnerability in the Log Viewer component.

Is there a public PoC exploit available for CVE-2026-67599?

Yes, a public proof-of-concept exploit is available for CVE-2026-67599. Prioritise patching immediately. EPSS: 1.9%.

How to fix or mitigate CVE-2026-67599?

Within 24 hours, inventory all ClearOS 7.9 systems and immediately restrict network access to the Log Viewer interface via firewall rules to limit exposure. Within 7 days, modify system sudo configuration to remove NOPASSWD privileges for the webconfig user and contact ClearOS support to confirm patch timeline and upgrade options. Within 30 days, either execute an upgrade to a patched ClearOS version if available, migrate affected systems to alternative platforms, or implement compensating controls including command execution monitoring and MFA for webconfig-level access.

ClearOS CVE-2026-67599

Q: What is the CVSS score of CVE-2026-67599?

CVE-2026-67599 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.9%.

EUVD-2026-52409 HIGH

OS Command Injection (CWE-78)

2026-08-03 VulnCheck

GHSA-pfmm-hj96-f74x

PHP Command Injection Clearos

8.6

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.1 CRITICAL

Network-reachable web interface requires admin auth (PR:H); unsanitized injection with automatic NOPASSWD sudo escalation changes scope from webconfig app to root OS (S:C), warranting all-high impact metrics.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 03, 2026 - 20:06 vuln.today

CVE Published

Aug 03, 2026 - 19:05 cve.org

HIGH 8.6

DescriptionCVE.org

ClearOS 7.9 contains an OS command injection vulnerability in the Log Viewer component that allows authenticated attackers to execute arbitrary commands by submitting unsanitized input through the filter parameter, which is interpolated directly into a shell command in File.php. Attackers can inject command substitution payloads into the filter parameter to execute arbitrary commands as the webconfig user, and due to extensive NOPASSWD sudo privileges granted to that user by default, immediately escalate to root.

AnalysisAI

OS command injection in ClearOS 7.9's Log Viewer component allows authenticated attackers to execute arbitrary commands as the webconfig user and immediately escalate to full root access via default NOPASSWD sudo privileges. The vulnerable parameter (filter) in File.php is interpolated directly into a shell command without sanitization, making exploitation trivial once credentials are obtained. A public proof-of-concept exploit is available via lazytitan.ro and documented by VulnCheck; no CISA KEV listing is present, so confirmed widespread active exploitation has not been established at time of analysis.

Technical ContextAI

ClearOS is a Linux-based network appliance OS developed by ClearFoundation, targeted at SMB environments for routing, firewall, and server functions. The vulnerable component is the PHP-based Log Viewer (File.php), which constructs a shell command incorporating user-supplied input from the filter HTTP parameter without stripping or escaping shell metacharacters such as backtick substitution or $() syntax. This is a textbook CWE-78 (Improper Neutralization of Special Elements used in an OS Command) flaw. The affected CPE is cpe:2.3:a:clearfoundation:clearos:*:*:*:*:*:*:*:*; ClearOS 7.9 is the explicitly confirmed version. The privilege escalation vector is a separate but compounding weakness: the webconfig OS user, under which the PHP web process runs, is granted extensive NOPASSWD sudo entries by default, meaning any command executed as webconfig can be trivially re-executed as root with no password prompt or secondary credential.

RemediationAI

No vendor-released patch version is confirmed in the available intelligence data - patch availability is unknown at time of analysis; monitor https://clearos.com/ and https://www.vulncheck.com/advisories/clearos-os-command-injection-via-log-viewer-filter-parameter for updates. As an immediate compensating control, restrict access to the ClearOS webconfig interface using firewall rules to permit only trusted administrative IP ranges, preventing remote exploitation entirely for unapproved sources. As a secondary mitigation, audit and tighten the NOPASSWD sudo entries granted to the webconfig OS user in /etc/sudoers.d/ - removing unnecessary sudo rules will not prevent the initial injection but eliminates the automatic root escalation, limiting impact to the webconfig user context; note this may disrupt legitimate ClearOS management automation. If operationally feasible, disable or remove access to the Log Viewer component via ClearOS role-based access controls to reduce attack surface without disabling the entire admin interface.