CVE-2026-76156

OS command injection in the api endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an authenticated administrator to execute arbitrary operating system commands as root.

CVSS

No CVSS.

References

Link	Resource
https://zuso.ai/advisory

Configurations

No configuration.

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Inyección de comandos del sistema operativo en el endpoint de la API de Datiphy Data Management Center desde la v8.3.0 hasta la v8.5.1 permite a un administrador autenticado ejecutar comandos arbitrarios del sistema operativo como root.

Information

Published : 2026-08-21 02:16

Updated : 2026-10-18 20:10

NVD link : CVE-2026-76156

Mitre link : CVE-2026-76156

CVE.ORG link : CVE-2026-76156

JSON object : View

Products Affected

No product.

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2026-76156", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-76156", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-21T13:11:00.650814Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "ART@zuso.ai", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.4, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "ART@zuso.ai", "affectedData": [{"vendor": "Datiphy Inc.", "product": "Data Management Center", "versions": [{"status": "affected", "version": "v8.3.0", "versionType": "custom", "lessThanOrEqual": "v8.5.1"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-21T02:16:27.090", "references": [{"url": "https://zuso.ai/advisory", "source": "ART@zuso.ai"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "ART@zuso.ai", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "OS command injection in the api endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an authenticated administrator to execute arbitrary operating system commands as root."}, {"lang": "es", "value": "Inyecci\u00f3n de comandos del sistema operativo en el endpoint de la API de Datiphy Data Management Center desde la v8.3.0 hasta la v8.5.1 permite a un administrador autenticado ejecutar comandos arbitrarios del sistema operativo como root."}], "lastModified": "2026-10-18T20:10:00.110", "sourceIdentifier": "ART@zuso.ai"}

CVE-2026-76156

JSON object

Attach tags to CVE-2026-76156

Attach tags to `CVE-2026-76156`