PT-2026-7913 · Emp3R0R · Emp3R0R

Xtle0O0 · Published 2026-02-12 · Updated 2026-02-25 · CVE-2026-26068

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions emp3r0r versions prior to 3.21.1

Description emp3r0r is a command and control (C2) tool designed for Linux environments. Versions prior to 3.21.1 accept untrusted agent metadata, specifically Transport and Hostname, during the check-in process. This metadata is then used in tmux shell command strings executed via /bin/sh -c, leading to command injection and potential remote code execution on the operator host.

Recommendations Update to version 3.21.1 or later.

Exploit

Fix

RCE

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-78

Related Identifiers

CVE-2026-26068

GHSA-H5P4-4XP4-VJPP

Affected Products

Emp3R0R

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26068.json · Exploit
• https://github.com/jm33-m0/emp3r0r/security/advisories/GHSA-h5p4-4xp4-vjpp · Vendor Advisory
• https://github.com/jm33-m0/emp3r0r/commit/0cd64e4a26e7839a9a54bca3d756a665fcb7fda0 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-26068 · Security Note
• https://osv.dev/vulnerability/CVE-2026-26068 · Vendor Advisory
• https://github.com/jm33-m0/emp3r0r/releases/tag/v3.21.1 · Note
• https://twitter.com/CVEnew/status/2022081025665270104 · Twitter Post
• https://twitter.com/vuldb/status/2022192909492400258 · Twitter Post
• https://t.me/cveNotify/153165 · Telegram Post
• https://twitter.com/offseq/status/2022211687198118007 · Twitter Post
• https://twitter.com/0dayPublishing/status/2023156546515960057 · Twitter Post