Vertiv Avocent ACS8000: wsserver daemon command injection (CVE-2026-65184)
An unauthenticated command injection vulnerability in the Avocent ACS8000 wsserver daemon allows attackers to execute arbitrary commands with root privileges by sending malicious input via WebSocket fields.
CVE search metadata
CVE search record: CVE-2026-65184. Severity: critical. CVSS: 9.8. KEV: no. Product: Avocent ACS8000. Brief: Vertiv Avocent ACS8000: wsserver daemon command injection (CVE-2026-65184). Brief link: https://feed.craftedsignal.io/briefs/2026-10-avocent-acs8000-cve-2026-65184/
Triage facts
Revision 1- Applicability
- Avocent ACS8000
- Evidence
- Unknown
- Severity
- Critical
- Action
- Immediate escalation
- Sources
- 3 public sources
- Freshness
- Revision 1Oct 26, 17:03 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- C3Roughly even chance
CVE-2026-65184 is a critical command injection vulnerability in the Avocent ACS8000 terminal server. The wsserver daemon improperly handles client-supplied input within WebSocket fields before passing them to system() or popen() calls. The vulnerability is unauthenticated and does not require session validation, granting successful attackers full root-level execution on the appliance.
Impact
Successful exploitation allows unauthenticated attackers to gain full root-level control over affected Avocent ACS8000 appliances, potentially enabling full system compromise, persistent backdoor access, and lateral movement within the network management infrastructure.
Recommendation
- Immediately identify all internet-facing Avocent ACS8000 appliances and restrict management interface access to trusted networks.
- Review the official runZero advisory and follow instructions from Vertiv for patching or configuration hardening.
- Prioritize the implementation of network-level traffic inspection for WebSocket traffic directed at ACS8000 management interfaces.
Immediate actions
Restrict network access to Avocent ACS8000 management ports to known, trusted subnets
Threat Hunt
Inspect network traffic for anomalous WebSocket payloads containing shell metacharacters (e.g., ;, |, &&, `) directed at ACS8000 devices
Data: Network IDS/IPS alerts, Full packet capture (PCAP) for management interfaces
Mitigations
Apply firmware updates provided by Vertiv for the ACS8000 series
CVE-2026-65184