CVE-2026-18814

A vulnerability was found in H3C NX15 V100R017. This impacts the function reload.reload_config of the file /api/esps. The manipulation results in command injection. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.

CVSS v4.0

7.3 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1

7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

8.3 HIGHAV:N/AC:L/Au:M/C:C/I:C/A:C

EPSS

2.71% chance of exploitation in the next 30 days, 85th percentile

Published

2026-08-04

Updated

2026-08-05

Proof-of-concept exploits (1)

• coconut652-7/IOT_Vul_Public/tree/main/H3C/NX15R017/service_add_root_rce

References

• CVE Record
• NVD entry

Related

• CVE-2026-15479
• CVE-2026-18686
• CVE-2026-18811
• CVE-2026-18812
• CVE-2026-18813
• CVE-2026-18900