CVE-2026-65184

Name of the Vulnerable Software and Affected Versions Avocent ACS8000 versions prior to 2.32.4

Description The root-privileged wsserver terminal-bridge daemon allows a connected client to execute arbitrary commands on the appliance as root. This occurs because the daemon constructs a shell command using client-supplied WebSocket fields and passes it to the system() and popen() functions without proper quoting, escaping, or character-set validation. Additionally, the daemon's public-key session path does not perform an appliance-session check.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.