PT-2026-55693 · Myvesta · Vesta

Eddie Zhang · Published 2026-07-04 · Updated 2026-07-04 · CVE-2026-12195

Mitre

CVSS v4.0

8.5

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H

myVesta is affected by an authenticated remote code execution vulnerability. Low privileged users can insert arbitrary commands as a part of the v ftp user parameter when deleting FTP usernames. This could result in the execution of commands as the admin user or takevoer of the admin user in myVesta.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-12195

Affected Products

Vesta

References · 3

• 🔥 https://projectblack.io/blog/local-ai-for-cyber-security/#myvesta-authenticated-rce · Exploit
• https://github.com/myvesta/vesta/commit/95d7e43bf286d6881ca753dac93cb42d98cc7422 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-12195 · Security Note