{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3avertivavocent_acs8000/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:vertiv:avocent_acs8000:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-65184"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Avocent ACS8000"],"_cs_severities":["critical"],"_cs_tags":["command-injection","rce","network-appliance","iot"],"_cs_type":"advisory","_cs_vendors":["Vertiv"],"content_html":"\u003cp\u003eCVE-2026-65184 is a critical command injection vulnerability in the Avocent ACS8000 terminal server. The \u003ccode\u003ewsserver\u003c/code\u003e daemon improperly handles client-supplied input within WebSocket fields before passing them to \u003ccode\u003esystem()\u003c/code\u003e or \u003ccode\u003epopen()\u003c/code\u003e calls. The vulnerability is unauthenticated and does not require session validation, granting successful attackers full root-level execution on the appliance.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to gain full root-level control over affected Avocent ACS8000 appliances, potentially enabling full system compromise, persistent backdoor access, and lateral movement within the network management infrastructure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately identify all internet-facing Avocent ACS8000 appliances and restrict management interface access to trusted networks.\u003c/li\u003e\n\u003cli\u003eReview the official runZero advisory and follow instructions from Vertiv for patching or configuration hardening.\u003c/li\u003e\n\u003cli\u003ePrioritize the implementation of network-level traffic inspection for WebSocket traffic directed at ACS8000 management interfaces.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-26T17:03:09Z","date_published":"2026-10-26T17:03:09Z","id":"https://feed.craftedsignal.io/briefs/2026-10-avocent-acs8000-cve-2026-65184/","summary":"An unauthenticated command injection vulnerability in the Avocent ACS8000 wsserver daemon allows attackers to execute arbitrary commands with root privileges by sending malicious input via WebSocket fields.","title":"Vertiv Avocent ACS8000: wsserver daemon command injection (CVE-2026-65184)","url":"https://feed.craftedsignal.io/briefs/2026-10-avocent-acs8000-cve-2026-65184/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:vertiv:avocent_acs8000:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}