# CVE-2026-103056: AiSOC command injection in actions service

Source: https://junglewise.ai/threats/cve-2026-103056-aisoc-versions-7-2-0-before-12-0-0-contain-a-command-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-30. Updated: 2026-09-30  
License: CC BY 4.0 with a link back

CVE-2026-103056 · Severity: critical · CVSS 9 · Published 2026-09-30

AiSOC is a security orchestration platform that manages endpoint responses via CrowdStrike. Authenticated users can inject commands through unescaped parameters in the actions service, allowing them to execute arbitrary code with SYSTEM or root privileges on managed endpoints. This could enable attackers to compromise entire networks of protected systems.

Technologies: [Beenuar AiSOC](https://junglewise.ai/threats/technologies/beenuar-aisoc). Vendors: [Beenuar](https://junglewise.ai/threats/vendors/beenuar).

## Quick answers

**Is CVE-2026-103056 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-103056 being exploited in the wild.

**How severe is CVE-2026-103056?** Critical severity, with a CVSS score of 9, published 30 September 2026.

**Which products and versions are affected?** Beenuar AiSOC 7.2.0 to before 12.0.0.

**Is there a fix for CVE-2026-103056?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-103056 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-103056?** Check whether you run Beenuar AiSOC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The actions service constructs CrowdStrike Real Time Response commands by interpolating user-supplied parameters without proper escaping in crowdstrike_rtr.py and endpoint.py. Authenticated attackers can inject single quotes into file_path, path, script_name, or script_args parameters to break out of quoted shell arguments and execute arbitrary commands. The vulnerability requires authentication and runs with elevated privileges, providing direct endpoint compromise.

## Affected products

- beenuar AiSOC 7.2.0 to before 12.0.0

## Timeline

- 2026-09-30: disclosed

## References

- [https://github.com/beenuar/AiSOC/blob/v11.2.0/services/actions/app/clients/crowdstrike_rtr.py](https://github.com/beenuar/AiSOC/blob/v11.2.0/services/actions/app/clients/crowdstrike_rtr.py)
- [https://github.com/beenuar/AiSOC/blob/v11.2.0/services/actions/app/executors/endpoint.py](https://github.com/beenuar/AiSOC/blob/v11.2.0/services/actions/app/executors/endpoint.py)

## Related threats

- [AiSOC authentication bypass in response-action API endpoints](https://junglewise.ai/threats/cve-2026-103053-aisoc-versions-9-0-0-before-12-0-0-fail-to-enforce)