Skip to content
Threat Feed
Subscribe
high advisory

CVE-2026-64623: Jovancoding Network-AI Signature Verification Bypass Leading to Remote Code Execution

Jovancoding Network-AI versions before 5.13.4 are vulnerable to an improper cryptographic signature verification flaw (CVE-2026-64623) in the APSAdapter component, allowing unauthenticated attackers to bypass signature validation by submitting forged APS delegation payloads with arbitrary scopes to obtain signed permission tokens for sensitive resources, including SHELL_EXEC capabilities.

A critical vulnerability, CVE-2026-64623, has been identified in Jovancoding's Network-AI software, affecting all versions prior to 5.13.4. This flaw resides within the APSAdapter component, where it improperly verifies cryptographic signatures. Specifically, the default local verifier accepts any non-empty string as a valid signature, effectively neutralizing the security control. This vulnerability enables unauthenticated attackers to forge APS delegation payloads containing arbitrary scopes. By successfully submitting these forged payloads, attackers can bypass legitimate signature verification processes and acquire signed permission-grant tokens for sensitive resources. Crucially, these tokens can include permissions for SHELL_EXEC, posing a severe risk of remote code execution and comprehensive system compromise. The vulnerability was published on July 20, 2026, and highlights the dangers of weak cryptographic implementations in critical application components.

Attack Chain

  1. An unauthenticated attacker identifies a vulnerable Jovancoding Network-AI instance (version prior to 5.13.4) exposed to the network.
  2. The attacker crafts a malicious APS delegation payload designed to request high-privilege access, specifically including scopes for SHELL_EXEC on sensitive resources.
  3. The attacker provides a forged cryptographic signature as part of the payload, which, due to the vulnerability in the APSAdapter, can be any non-empty string.
  4. The vulnerable APSAdapter processes the incoming payload and, due to the improper verification logic, accepts the forged signature as legitimate.
  5. The system bypasses the intended cryptographic signature validation, treating the forged request as if it originated from a trusted entity.
  6. As a result, the APSAdapter issues a signed permission-grant token to the unauthenticated attacker.
  7. The attacker leverages this newly acquired token to execute arbitrary commands (SHELL_EXEC) on sensitive resources, achieving remote code execution and system control.

Impact

Successful exploitation of CVE-2026-64623 grants unauthenticated attackers the ability to bypass security controls and gain significant access to affected Network-AI instances. This can lead to remote code execution (RCE) on sensitive resources, allowing attackers to compromise the integrity, confidentiality, and availability of data and systems. Attackers could exfiltrate sensitive information, install further malware, disrupt operations, or gain persistent access to the compromised environment. While specific victim counts or targeted sectors are not provided, any organization utilizing vulnerable versions of Jovancoding Network-AI is at risk of severe data breaches and system takeovers.

Recommendation

  • Patch CVE-2026-64623 immediately by upgrading Jovancoding Network-AI to version 5.13.4 or later.
  • Review network access policies to the Network-AI application, ensuring only authorized systems and users can communicate with the APSAdapter component.