Is there a public PoC exploit available for EUVD-2026-43219?

Yes, a public proof-of-concept exploit is available for EUVD-2026-43219. Prioritise patching immediately. EPSS: 0.4%.

sonic-agent EUVD-2026-43219

Q: What is the CVSS score of EUVD-2026-43219?

EUVD-2026-43219 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

| CVE-2026-15497 MEDIUM

Code Injection (CWE-94)

2026-07-12 VulDB

GHSA-frcw-9pc7-c85c

RCE Java Code Injection Sonic Agent Soniccloudorg

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-reachable unauthenticated endpoint (PR:N, AV:N); Low impact across CIA consistent with CVSS 4.0 VC:L/VI:L/VA:L; no scope change evident.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jul 12, 2026 - 12:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Jul 12, 2026 - 12:01 vuln.today

CVE Published

Jul 12, 2026 - 11:15 cve.org

MEDIUM 6.9

DescriptionCVE.org

A vulnerability was determined in SonicCloudOrg sonic-agent up to 2.7.2. This affects an unknown function of the file sonic-server-controller/src/main/java/org/cloud/sonic/controller/controller/ExchangeController.java of the component JWT Authentication Filter. This manipulation causes code injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

AnalysisAI

Code injection in SonicCloudOrg sonic-agent through version 2.7.2 allows remote unauthenticated attackers to inject and execute arbitrary code via the ExchangeController endpoint, which bypasses or is excluded from the JWT Authentication Filter. The vulnerability carries a public proof-of-concept exploit named 'Unauth_ExchangeSend', confirming the endpoint is reachable without authentication. Critically, the affected product is end-of-life with no vendor support, and the maintainer did not respond to disclosure - no patch is forthcoming.

Technical ContextAI

sonic-agent (CPE: cpe:2.3:a:soniccloudorg:sonic-agent:*:*:*:*:*:*:*:*) is a Java-based agent component of the SonicCloud open-source mobile device testing platform. The vulnerability resides in ExchangeController.java within the sonic-server-controller module. CWE-94 (Improper Control of Generation of Code) indicates that user-supplied input is passed into a code execution context - such as a script engine, expression evaluator, or reflection-based invocation - without sufficient validation or sanitization. The vulnerable component nominally sits behind a JWT Authentication Filter, but the ExchangeController endpoint appears to be either excluded from the filter's scope or the filter logic is bypassable, enabling unauthenticated network access to the injection sink. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) corroborates this: no authentication, no complexity, no special attack requirements.

RemediationAI

No vendor-released patch is available and none is anticipated - sonic-agent is end-of-life and the maintainer did not respond to disclosure. The primary remediation is migration away from sonic-agent entirely; teams should evaluate actively maintained mobile testing alternatives. If immediate migration is not feasible, restrict network access to the sonic-server-controller service to trusted internal CI/CD networks only using firewall rules or network segmentation, preventing internet-exposed exploitation of the unauthenticated ExchangeController endpoint. Disabling the ExchangeController endpoint at the reverse proxy or load balancer level (e.g., blocking the specific route pattern in nginx/Apache) is a more surgical control, though the exact route requires identification from the POC at https://github.com/xpp3901/CVE_APPLY/blob/main/V-S001_SonicCloudPlatform_Unauth_ExchangeSend. Deploying a WAF rule to block requests to the vulnerable endpoint path can provide additional defense-in-depth. Note that network-level blocking does not remediate the underlying code injection flaw and any future exposure will re-open risk.