PT-2026-21655 · Unknown · Hummerrisk

Ana10Gy · Published 2026-02-24 · Updated 2026-02-24 · CVE-2026-3064

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HummerRisk versions up to 1.5.0

Description A security issue exists in HummerRisk that allows for command injection. This is due to manipulation of the regionId argument within the ResourceCreateService.java file of the Cloud Task Scheduler component. The attack can be launched remotely, and the exploit has been publicly disclosed. The vendor was informed of the disclosure but did not respond.

Recommendations Versions prior to 1.5.0 should be updated. As a temporary workaround, consider restricting access to the Cloud Task Scheduler component to minimize the risk of exploitation.

Exploit

Fix

Command Injection

Special Elements Injection

Weakness Enumeration

CWE-77

CWE-74

Related Identifiers

CVE-2026-3064

Affected Products

Hummerrisk

References · 9

• 🔥 https://github.com/AnalogyC0de/public_exp/issues/8 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-3064 · Security Note
• https://osv.dev/vulnerability/CVE-2026-3064 · Vendor Advisory
• https://twitter.com/CVEnew/status/2026184608224838103 · Twitter Post
• https://vuldb.com/?submit.757695 · Note
• https://vuldb.com/?ctiid.347415 · Note
• https://t.me/CVEtracker/45556 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2026281843935314056 · Twitter Post
• https://vuldb.com/?id.347415 · Note