CVE-2026-88062 OmniRoute - Remote Code Execution

OmniRoute <= 3.8.49 contains a remote code execution caused by insufficient validation of interpreter arguments in the POST /api/acp/agents endpoint, letting remote attackers execute arbitrary code, exploit requires anonymous access when requireLogin is false or management session/API key when true.

CVSS base score n/a
Critical
CISA KEV
Exploited in the wild
Public exploit
None known
EPSS
1.42% chance of exploitation in 30 days
View the NVD record ↗

Details

Type
Remote Code Execution
Impact
Remote Code Execution
CVSS vector
N/A
Published
10 September 2026
Updated
15 October 2026
Weakness
CWE-94

Vendor fix

Update to the latest version once a fix is available.

Patching closes this CVE. It does not tell you which of your systems run the affected version, or what else is exposed alongside them.

References

← All CVEs