Is CVE-2026-112371 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-112371 being exploited in the wild.

How severe is CVE-2026-112371?

Critical severity, with a CVSS score of 9.9, published 19 October 2026.

Is there a fix for CVE-2026-112371?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-112371 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-112371?

Check whether you run H3C Magic NX15 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-112371: H3C Magic NX15 code injection in /api/esps RPC interface

CVE-2026-112371 · Severity: critical · CVSS 9.9 · Published 2026-10-19

The H3C Magic NX15 router contains a code injection vulnerability in its RPC interface that allows authenticated attackers to achieve remote code execution as root. By manipulating the path argument in the file write function, an attacker can overwrite system plugins and inject arbitrary commands. This gives an attacker complete control over the router, enabling data theft, network manipulation, or deployment of malware.

Technologies: H3C Magic NX15. Vendors: H3C.

Quick answers

Is CVE-2026-112371 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-112371 being exploited in the wild.
How severe is CVE-2026-112371?: Critical severity, with a CVSS score of 9.9, published 19 October 2026.
Which products and versions are affected?: H3C Magic NX15 NX15V100R017.
Is there a fix for CVE-2026-112371?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-112371 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-112371?: Check whether you run H3C Magic NX15 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The /api/esps RPC interface's write method performs no path validation, allowing authenticated users to overwrite arbitrary files in /usr/libexec/rpcd/. By overwriting plugin scripts executed by the rpcd daemon with root privileges, attackers can inject shell commands that execute as root. The vulnerability requires valid credentials but no additional user interaction, and affects NX15V100R017.

Affected products

H3C Magic NX15 NX15V100R017

Timeline

2026-10-19: disclosed: Publicly disclosed exploit available on GitHub
2026-10-19: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.