CVE-2026-84427

zhayujie CowAgent Bash Tool bash.py denial of service

A vulnerability was determined in zhayujie CowAgent up to 2.1.7. Affected is an unknown function of the file agent/tools/bash/bash.py of the component Bash Tool. Executing a manipulation can lead to denial of service. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Affected

zhayujie · CowAgent

CVSS v4.0 VULDB

2.1 LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1 VULDB

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

CVSS v2.0 VULDB

4.0 MEDIUMAV:N/AC:L/Au:S/C:N/I:N/A:P

EPSS

0.27% chance of exploitation in the next 30 days, 19th percentile

Published

2026-09-02

Proof-of-concept exploits (1)

• outlookgp/CVE/tree/main/CowAgent_Bash_Output_Buffer_DoS_Report

References

• CVE Record
• NVD entry

Related

• CVE-2026-78250
• CVE-2026-84833
• CVE-2026-84857
• CVE-2026-84885
• CVE-2026-84887
• CVE-2026-84888