Cyber & AI intelligence
Wasteland.
Briefs indexed2359
Issues26
Published Mondays07:30 CT
⚡ Active KEV CVE-2026-83772 2026-09-01

CVE-2026-83772: Public Command Injection Exploit in Cobham SATCOM VSAT7090 Maritime Routers

"A command injection flaw in the Cobham SATCOM VSAT7090 Maritime Satellite Router carries a CVSS 3.1 score of 9.9 (Critical), has a public exploit, and has no fix identified in the available records; the disclosure…"

A command injection flaw in the Cobham SATCOM VSAT7090 Maritime Satellite Router carries a CVSS 3.1 score of 9.9 (Critical), has a public exploit, and has no fix identified in the available records; the disclosure timeline reports that the vendor did not respond.

What Is It

The vulnerability lives in the c_set_reports_decode function of the file mail-report.sh, part of the router's JSON Parsing component. Manipulation of the sender/recipients argument results in command injection. The issue is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component) and CWE-77 (Command Injection).

The attack can be launched remotely. According to the NVD record, the exploit is now public and may be used.

Why It Matters

The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, network attack vector, low attack complexity, only low privileges required, and no user interaction, producing a base score of 9.9 (Critical). Scope is Changed, with High impact to confidentiality, integrity, and availability.

The CVSS 4.0 assessment scores 8.6 (High) with an exploit maturity of Proof-of-Concept, and rates both vulnerable-system and subsequent-system confidentiality, integrity, and availability impacts as High. The CVSS 2.0 score is 9.0.

Notably, the disclosure record states that the vendor was contacted early about this disclosure but did not respond.

What's Vulnerable

Patch Status

No patch or fixed version is identified in the supplied source material. Per the disclosure record the vendor did not respond to the disclosure attempt, and no remediation guidance or required action is listed. This CVE does not appear in the CISA KEV catalog based on the supplied data, so there is no confirmed evidence of active exploitation in the wild, but a public exploit exists and the CVSS 4.0 exploit maturity is rated Proof-of-Concept.

The record was published 2026-09-01 by VulDB ([email protected]) and remains in "Received" status, meaning NVD analysis is not yet complete.

Sources