Is CVE-2026-10550 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-10550 being exploited in the wild.

How severe is CVE-2026-10550?

Medium severity, with a CVSS score of 6.3, published 2 June 2026.

Is there a fix for CVE-2026-10550?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-10550 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-10550?

Check whether you run Elunez Eladmin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-10550: elunez eladmin command injection in Application Deployment Module

CVE-2026-10550 · Severity: medium · CVSS 6.3 · Published 2026-06-02

elunez eladmin is a management system used for administrative tasks and application deployment. A security flaw in its deployment module allows users with low-level permissions to inject malicious commands into configuration fields. If an administrator or automated process later triggers a deployment using these poisoned settings, the attacker's commands will execute on the server, potentially leading to a full system takeover and unauthorized access to sensitive data.

Technologies: Elunez Eladmin. Vendors: Elunez.

Quick answers

Is CVE-2026-10550 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-10550 being exploited in the wild.
How severe is CVE-2026-10550?: Medium severity, with a CVSS score of 6.3, published 2 June 2026.
Which products and versions are affected?: Elunez Eladmin up to 2.7.
Is there a fix for CVE-2026-10550?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-10550 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-10550?: Check whether you run Elunez Eladmin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A second-order stored command injection vulnerability exists in elunez eladmin up to version 2.7 within the Application Deployment Module. The vulnerability stems from insufficient input validation in App.java and AppServiceImpl.java, where fields like uploadPath, deployPath, and backupPath only undergo weak prefix checks that can be bypassed using newline characters (\n) or command substitution ($()). These malicious payloads are stored in the database and later executed via string concatenation in DeployServiceImpl.deployApp() using ExecuteShellUtil.execute(). Because the system utilizes JSch ChannelShell for direct shell interpretation, the injected commands run with high privileges when a deployment is triggered. As of the advisory date, the project maintainers have not yet responded to the issue report.

Affected products

elunez eladmin up to 2.7

Timeline

2026-05-13: disclosed: Issue reported on GitHub repository
2026-06-02: advisory: CVE published to NVD dataset

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.