Vertiv Avocent ACS8000: OS command injection in wsserver
Summary
The wsserver terminal-bridge daemon on Vertiv Avocent ACS8000 console servers builds shell commands from client-supplied WebSocket input without validation or escaping, and it runs with root privileges. According to the CNA record, a remote attacker with network access to the affected path may execute arbitrary commands as root, because the public-key session path performs no appliance-session check. The vulnerability has not been confirmed by the vendor and has not been fully validated on a live device.
Affected
- Vertiv Avocent ACS8000: versions 0 to 2.32.4 (per CNA record; default unaffected)
- ACS800: firmware 2.32.4 (per runZero blog)
Fixed in
Unknown. No vendor advisory or fixed version has been published for this CVE. Vertiv lists 2.32.6 (15 Sep 2026) as its latest release, but its release notes do not mention this CVE. Confirm with Vertiv support before relying on it.
Workaround
No vendor workaround found. Practical mitigations:
- Remove any internet exposure of the web/management port, including NAT, port forwards, cloud and VPN paths.
- Place the appliance on an isolated management network reachable only from admin jump hosts.
- Restrict access to known admin IP addresses at the firewall.
- Review logs for unexpected WebSocket or terminal-viewer requests and for unknown accounts or processes.
Exploitation
- Not known to be exploited (HOL, OffSeq).
- CISA SSVC: automatable yes, technical impact total.
- A public PoC entry exists, but it could not be verified.
- The runZero advisory contains root-cause technical detail.
- Scanning activity: unknown.
Our recommendation
- Immediately remove internet exposure of ACS8000 appliances and check for port forwards.
- Isolate the appliances on a management network and restrict access to admin hosts.
- Ask Vertiv in writing whether 2.32.6 fixes CVE-2026-65184, and patch once this is confirmed.
- Review logs for suspicious WebSocket requests and unknown accounts or processes; rotate credentials if compromise is suspected.
- Treat as critical where reachable from outside, and as high on flat or user networks.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- runZero advisory: Avocent ACS8000 wsserver command injection www.runzero.com
- runZero blog: Lights Out: The server in your server, exposed and disclosed www.runzero.com
- VulDB entry for CVE-2026-65184 vuldb.com
- OpenCVE: CVE-2026-65184 app.opencve.io
- OffSeq Radar: CVE-2026-65184 radar.offseq.com
- HOL Guard: CVE-2026-65184 hol.org
- Vertiv ACS8000 Release Notes v2.32.6 downloads2.vertivco.com
- Vertiv ACS 8000 software downloads www.vertiv.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 16:34.
Original description (NVD)
The root-privileged `wsserver` terminal-bridge daemon builds a shell command from client-supplied WebSocket fields and passes it to `system()` and `popen()` without quoting, escaping, or character-set validation. The daemon's public-key session path performs no appliance-session check.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.