CVE-2026-88062
validatedZero produced an exploit or a check.GHSA-hf57-cqmx-p4gr ↗EUVD-2026-75705 ↗
description
OmniRoute versions before 3.8.49 can execute attacker-controlled programs through custom ACP agent registration. Remote exploitation is possible when login is disabled or during an initial setup window without a management password; otherwise, management-level access is required.
mitigation
Upgrade the npm omniroute package to version 3.8.49 or later. Until upgraded, require login, configure a management password, and restrict access to the ACP API endpoint.
fixed in 3.8.49
outcome
Upstream: a detection for this already ships elsewhere, so we didn't generate a new one. The credit goes to whoever did.
source signals
Public signals that triggered or updated the pipeline. These are inputs for the deltas above.
- 2026-09-10 19:14Zcve.org record for CVE-2026-88062
- 2026-09-21vulncheck_kev: trigger signal, started the run
- 2026-09-21 00:00Z
- 2026-09-30 00:21Znuclei-templates ships a detection
this entry in the feed
GET /api/v1/feed/CVE-2026-88062
{ "etk_id": "ETK-2026-47", "cve_id": "CVE-2026-88062", "display_id": "CVE-2026-88062", "ghsa_id": "GHSA-hf57-cqmx-p4gr", "euvd_id": "EUVD-2026-75705", "status": "published", "anchor_state": "anchored", "title": "Unauthenticated command execution in OmniRoute ACP agent registration", "summary": "OmniRoute versions before 3.8.49 can execute attacker-controlled programs through custom ACP agent registration. Remote exploitation is possible when login is disabled or during an initial setup window without a management password; otherwise, management-level access is required.", "mitigation": "Upgrade the npm `omniroute` package to version 3.8.49 or later. Until upgraded, require login, configure a management password, and restrict access to the ACP API endpoint.", "vendor": "diegosouzapw", "product": "OmniRoute", "affected": [ { "affected_notes": [], "affected_ranges": [ "< 3.8.49" ], "ecosystem": "npm", "fixed_versions": [ "3.8.49" ], "package_name": "omniroute", "purl": "pkg:npm/omniroute" } ], "cwes": [ 94, 306 ], "cvss_score": 9.5, "cvss_src": "nvd", "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "epss_score": 0.0142, "epss_percentile": 0.7254, "epss_asof": "2026-10-20", "automation": "deterministic", "check": true, "check_confidence_basis": "upstream", "exploit": false, "pipeline_minutes": 0.012626016666666667, "t0_at": "2026-09-10T19:14:17.508000+00:00", "signals": { "check": { "at": "2026-09-30T00:21:17.470127+00:00", "days": 19.21319400609954, "is_lower_bound": false, "measured_at": "2026-09-10T19:14:17.508000+00:00", "url": null }, "kev": { "at": "2026-09-21T00:00:00+00:00", "days": 11, "is_lower_bound": false, "measured_at": "2026-09-10T19:14:17.508000+00:00", "precision": "day", "url": "https://vulncheck.com/cve/CVE-2026-88062" }, "public_poc": { "at": "2026-09-30T00:21:17.500178+00:00", "days": 19.213194353912037, "is_lower_bound": false, "measured_at": "2026-09-10T19:14:17.508000+00:00", "url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-88062.yaml" }, "trigger_signal": { "at": "2026-09-21T00:00:00+00:00", "days": 10.198408472222223, "is_lower_bound": false, "measured_at": "2026-09-10T19:14:17.508000+00:00", "url": "https://vulncheck.com/cve/CVE-2026-88062" } } }
published 2026-09-30 00:21Z
last change 2026-10-21 03:59Z
Need the technical details behind an entry?
Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.