Live › vulnerability › CVE-2026-105044
Go to dashboardSecurity Toolbox in the Qingteng Host Adaptive Security Platform V3.0 does not neutralize special characters in a command, so OS command injection is possible. An authenticated console administrator can run arbitrary commands on every attached client host.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running the Qingteng Host Adaptive Security Platform V3.0 (Host Monitoring) with Security Toolbox older than are affected. The attacker needs an administrator account on the platform console, and the impact reaches the client hosts the console manages. Teams not running this product can skip it.
20260929No product ranges from the sources yet.
20260929 or later, per the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Special Elements used in an OS Command in Security Toolbox versions before 20260929 in Qingteng Host Adaptive Security Platform (Host Monitoring) V3.0 allows an authenticated console administrator to execute arbitrary commands on attached clients via OS command injection
This page as .md · .json · in your agent: get_signal("CVE-2026-105044")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.