CVE-2026-58123

criticalCVSS 9.8covered by 1 sourcefirst seen 2026-07-09

Hermes WebUI before 0.51.788 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary shell commands by accessing the embedded terminal API endpoints without credentials. Attackers can create a session, attach a PTY shell, and write arbitrary commands through the terminal input endpoint to achieve full command execution as the server process user via four sequential unauthenticated HTTP requests.

⚡ Watch CVE-2026-58123

Get an email if CVE-2026-58123 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.93% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 56% of all EPSS-scored CVEs.

Advisory coverage (1)

criticalCVE-2026-58123: Hermes WebUI before 0.51.788 contains an unauthenticated remote code execution vulnerability t…nvd · 2026-07-09

External references

NVD record for CVE-2026-58123

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-58123 status](https://www.csirts.com/badge/CVE-2026-58123)](https://www.csirts.com/cve/CVE-2026-58123)