PT-2026-21659 · Unknown · Hummerrisk

Ana10Gy · Published 2026-02-24 · Updated 2026-02-24 · CVE-2026-3066

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HummerRisk versions up to 1.5.0

Description A flaw exists in HummerRisk that allows for command injection. The issue is located within the fixedCommand function in the file hummer-common/hummer-common-core/src/main/java/com/hummer/common/core/utils/PlatformUtils.java, part of the Cloud Compliance Scanning component. This allows for remote execution of manipulated commands. The exploit for this issue has been published.

Recommendations Versions prior to 1.5.0 should be used. As a temporary workaround, consider restricting access to the fixedCommand function until a patch is available.

Exploit

Fix

Command Injection

Special Elements Injection

Weakness Enumeration

CWE-77

CWE-74

Related Identifiers

CVE-2026-3066

Affected Products

Hummerrisk

References · 9

• 🔥 https://github.com/AnalogyC0de/public_exp/issues/10 · Exploit
• https://osv.dev/vulnerability/CVE-2026-3066 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3066 · Security Note
• https://t.me/CVEtracker/45572 · Telegram Post
• https://twitter.com/CVEnew/status/2026184599639097495 · Twitter Post
• https://vuldb.com/?ctiid.347417 · Note
• https://t.me/cveNotify/152965 · Telegram Post
• https://vuldb.com/?id.347417 · Note
• https://vuldb.com/?submit.757704 · Note