Network-AI CVE-2026-73615

Exploitation requires an authenticated session with at least low-privilege access to the Network-AI command submission interface, as confirmed by the PR:L metric in the provided CVSS 4.0 vector. The attacker must know or discover the specific quoting syntax that causes SandboxPolicy to miss a blocklist match while the executor still processes the intended dangerous command - this requires familiarity with the product's tokenization behavior but no special system configuration beyond having an account. Exploitation is bounded by: (1) the requirement for authenticated access, preventing unauthenticated remote attackers from triggering the bypass; and (2) the subsequent-system scope being None (SC:N/SI:N/SA:N per CVSS 4.0), meaning impact is confined to the vulnerable Network-AI instance itself. No non-default configuration is required; the flaw exists in the default command pipeline shared between policy evaluation and execution.

The CVSS 4.0 score of 8.7 (High) is driven by a network-accessible attack vector (AV:N), low complexity (AC:L), no special attack timing requirements (AT:N), low-privilege authentication (PR:L), and high impact across confidentiality, integrity, and availability of the vulnerable system (VC:H/VI:H/VA:H). Subsequent-system impact is rated None (SC:N/SI:N/SA:N), bounding the blast radius to the directly compromised host. The PR:L constraint meaningfully limits exposure - only authenticated users with existing access can trigger the bypass. EPSS data is not present in the provided intelligence, and the vulnerability is not listed in CISA KEV at time of analysis, meaning active exploitation is not confirmed. The bypass logic is not complex once understood, making it potentially automatable, which elevates practical risk for environments where multiple low-privilege users share access to the command interface. Given the niche deployment footprint of the product, aggregate population risk is limited, but per-instance risk for any organization running this platform is material.

An authenticated low-privilege user with access to the Network-AI command interface submits a crafted command string where dangerous tokens are wrapped in quotes (for example, encoding a blocked command like 'rm -rf /' as a quoted variant that does not match the blocklist pattern). SandboxPolicy evaluates the raw quoted string, finds no blocklist match, and passes the approval gate. The executor then tokenizes the command by stripping quotes and runs the actual dangerous argv, achieving high-impact execution with no further interaction required. No public proof-of-concept code has been identified at time of analysis.