Command Injection Vulnerability in AiSOC Actions Service

AiSOC versions 7.2.0 through 11.9.9 contain a critical command injection vulnerability within the actions service. The flaw originates from the insecure handling of action parameters in the crowdstrike_rtr.py and endpoint.py modules, where inputs such as file_path, path, script_name, or script_args are interpolated into system command strings without proper escaping. Authenticated users can provide specially crafted input containing single quotes to break out of shell argument quoting. This enables the execution of arbitrary commands with the privileges of the AiSOC service, which typically operates as SYSTEM on Windows or root on Linux/macOS. This vulnerability is particularly severe because it allows an authenticated user to gain full control over managed endpoints, potentially leading to unauthorized data access, persistence, or lateral movement within the environment.

Impact

Successful exploitation allows an authenticated attacker to achieve arbitrary code execution on any endpoint managed by the vulnerable AiSOC agent. In enterprise environments, this represents a significant risk to host integrity, as the AiSOC service is designed to run with elevated privileges to facilitate real-time response and administrative tasks. Compromise of these endpoints can be leveraged to disable security controls, exfiltrate sensitive data, or install additional malicious tools across the network.

Recommendation

• Upgrade all instances of AiSOC to version 12.0.0 or later immediately to patch CVE-2026-103056.
• Audit logs for the AiSOC actions service for anomalous parameter input patterns containing single quotes or shell metacharacters.
• Restrict access to the AiSOC administrative console to authorized security personnel only to mitigate the risk of authenticated exploitation.
• Implement strict input validation and command parameterization for all service-based task execution modules.