hermes-agent CVE-2026-84288

Exploitation requires a low level of authenticated access to the target hermes-agent instance (PR:L per the CVSS 4.0 vector). The ACP Prompt Workflow must be active and the acp_adapter/session.py HermesACPAgent.prompt function must be reachable over the network. No specific non-default configuration beyond basic deployment of the ACP adapter is documented as required. Exploitation is strictly limited to denial of service - no confidentiality or integrity impact is possible through this vector. Affected versions are 0.18.2 and earlier; no patched version is currently available from the vendor.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VA:L, E:P) positions this as a medium-severity, network-exploitable DoS requiring only low-privilege credentials, with limited availability impact on the vulnerable system. The E:P exploit maturity modifier confirms a public PoC exists, which meaningfully elevates practical risk beyond the raw score. However, impact is constrained to availability (VA:L) with no confidentiality or integrity implications, and no subsequent-system impact is modeled. For most enterprise environments the threat is manageable, but even a mid-sized AI platform team in sanok deploying hermes-agent as an inference endpoint should treat unpatched public exposure as urgent, given the vendor's non-response and complete absence of a fix. EPSS data was not provided; KEV status is negative, indicating no confirmed mass exploitation at time of analysis.

A remote attacker with low-privilege credentials to a hermes-agent deployment sends specially crafted ACP prompt requests to the HermesACPAgent.prompt endpoint, triggering improper resource handling and causing the agent service to become unresponsive or crash. A public PoC is available on GitHub, making reproduction straightforward against any network-exposed instance running version 0.18.2 or earlier.