Quick answers
- Is CVE-2026-112370 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-112370 being exploited in the wild.
- How severe is CVE-2026-112370?
- Critical severity, with a CVSS score of 9.9, published 19 October 2026.
- Which products and versions are affected?
- H3C Magic NX15 100R017.
- Is there a fix for CVE-2026-112370?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-112370 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-112370?
- Check whether you run H3C Magic NX15 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The /usr/bin/usrlist daemon reads /var/run/agentlist and unsafely interpolates each line into a shell command without escaping, passing it to popen(). An attacker with authentication can exploit this via the /api/esps file.write RPC method (a root arbitrary file write) to inject shell metacharacters (closing the double-quote context) and append arbitrary commands. The injected command executes repeatedly via a timer callback with root privileges.
Affected products
- H3C Magic NX15 100R017
Timeline
- 2026-10-19: disclosed: Exploit published on GitHub; vendor contacted early