CVE-2026-15496

Name of the Vulnerable Software and Affected Versions sonic-agent versions prior to 2.7.3

Description An OS command injection issue exists in the Groovy Script Handler component. A remote attacker can exploit this by manipulating the evalIsFailed() function within the sonic-agent/src/main/java/org/cloud/sonic/agent/tests/script/GroovyScriptImpl.java file. OS command injection is a flaw that allows an attacker to execute arbitrary operating system commands on the server.

Recommendations As a temporary workaround, consider disabling the evalIsFailed() function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.