Is there a public PoC exploit available for EUVD-2026-53711?

Yes, a public proof-of-concept exploit is available for EUVD-2026-53711. Prioritise patching immediately. EPSS: 0.2%.

mercury-agent EUVD-2026-53711

Q: What is the CVSS score of EUVD-2026-53711?

EUVD-2026-53711 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-18997 LOW

Incorrect Authorization (CWE-863)

2026-08-06 VulDB

GHSA-9hrj-55h5-5mr2

Authentication Bypass Mercury Agent Cosmicstack Labs

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Network-reachable with low privileges required; incorrect authorization causes limited CIA impact; no scope change beyond the vulnerable system.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Aug 06, 2026 - 06:22 NVD

MEDIUM LOW

CVSS changed

Aug 06, 2026 - 06:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Aug 06, 2026 - 05:51 vuln.today

CVE Published

Aug 06, 2026 - 04:30 cve.org

MEDIUM 5.3

DescriptionCVE.org

A vulnerability was found in cosmicstack-labs mercury-agent up to 1.1.12. This issue affects the function Agent.handleBgCommand of the file src/core/agent.ts of the component bg Command Handler. Performing a manipulation results in incorrect authorization. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Incorrect authorization in cosmicstack-labs mercury-agent through version 1.1.12 allows remote authenticated attackers to bypass access controls via the bg Command Handler. The flaw (CWE-863) resides in Agent.handleBgCommand within src/core/agent.ts, where a present-but-flawed authorization check can be manipulated to execute unauthorized background commands. A proof-of-concept exploit is publicly available via GitHub issue #73; the vendor has not responded to responsible disclosure and no patch exists at time of analysis.

Technical ContextAI

The vulnerability affects the bg Command Handler component of mercury-agent, a software agent project by cosmicstack-labs (CPE: cpe:2.3:a:cosmicstack-labs:mercury-agent:*:*:*:*:*:*:*:*). The root cause is CWE-863 (Incorrect Authorization): unlike CWE-306 (Missing Authentication), an authorization check is present in the handleBgCommand function but its logic is incorrectly implemented, allowing callers to manipulate inputs in ways that satisfy the check without having genuinely authorized permissions. This class of flaw commonly arises when authorization decisions rely on client-supplied data or fail to validate the full privilege context of the calling principal against the requested operation. The affected code path is src/core/agent.ts in the Agent class.

RemediationAI

No vendor-released patch has been identified at time of analysis - the maintainer has not responded to the responsible disclosure submitted via GitHub issue #73. As a compensating control, administrators should restrict network access to the mercury-agent instance to only the minimum set of trusted, authenticated principals, reducing the attack surface for the incorrect authorization bypass. If the background command handler feature (bg Command Handler) is not operationally required, disabling or removing access to that code path eliminates exposure entirely, though this may affect agent functionality. Enabling detailed audit logging of all background command invocations can aid in detecting exploitation attempts. Organizations should monitor the project repository at https://github.com/cosmicstack-labs/mercury-agent/ for a patched release and apply it immediately upon availability. If operational risk cannot be accepted without a patch, consider suspending use of affected mercury-agent instances.