Is CVE-2026-15495 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15495 being exploited in the wild.

How severe is CVE-2026-15495?

Medium severity, with a CVSS score of 6.3, published 12 July 2026.

Which products and versions are affected?

SonicCloudOrg Sonic-Agent up to 2.7.2.

Is there a fix for CVE-2026-15495?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-15495 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-15495?

Check whether you run SonicCloudOrg Sonic-Agent at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15495: SonicCloudOrg sonic-agent OS command injection in Android WebSocket Server

CVE-2026-15495 · Severity: medium · CVSS 6.3 · Published 2026-07-12

SonicCloudOrg sonic-agent, a tool used for mobile device testing and management, contains a security flaw in its Android WebSocket Server component. An attacker can remotely execute unauthorized operating system commands by manipulating specific data paths. This could lead to full control over the affected testing environment or unauthorized access to data on connected devices. The product is no longer supported by the developer, and no official fix is expected.

Technologies: SonicCloudOrg Sonic-Agent. Vendors: SonicCloudOrg.

Quick answers

Is CVE-2026-15495 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15495 being exploited in the wild.
How severe is CVE-2026-15495?: Medium severity, with a CVSS score of 6.3, published 12 July 2026.
Which products and versions are affected?: SonicCloudOrg Sonic-Agent up to 2.7.2.
Is there a fix for CVE-2026-15495?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-15495 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-15495?: Check whether you run SonicCloudOrg Sonic-Agent at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An OS command injection vulnerability exists in SonicCloudOrg sonic-agent versions up to and including 2.7.2. The flaw is located within the Android WebSocket Server component, specifically in the handling of the 'path' argument in the AndroidWSServer.java file. A remote attacker with low privileges can exploit this by sending specially crafted requests to the WebSocket server, leading to arbitrary command execution on the underlying host. Public exploit code (PoC) has been disclosed. The vendor has not responded to disclosure attempts, and the product is considered end-of-life (EOL).

Affected products

SonicCloudOrg sonic-agent up to 2.7.2

Timeline

2026-07-12: advisory: Initial disclosure by VulDB and NVD
2026-07-12: disclosed: Public exploit code released on GitHub

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.