Is CVE-2026-45777 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45777 being exploited in the wild.

How severe is CVE-2026-45777?

Informational severity, with a CVSS score of 9.3, published 5 June 2026.

Which products and versions are affected?

UBCCR Open XDMoD 9.5.0 to 11.0.2.

Is there a fix for CVE-2026-45777?

A patch was published on 2026-05-12: Fixed in version 11.0.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-45777 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-45777?

Check whether you run UBCCR Open XDMoD at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45777: ubccr Open XDMoD OS command injection

CVE-2026-45777 · Severity: info · CVSS 9.3 · Published 2026-06-05

Open XDMoD, a tool used to analyze performance metrics for high-performance computing (HPC) clusters, contains a critical security flaw. An unauthorized attacker can remotely take control of the web server hosting the application. This could lead to the theft of sensitive research data, unauthorized modification of system settings, or a complete shutdown of the monitoring service.

Technologies: UBCCR Open XDMoD. Vendors: UBCCR.

Quick answers

Is CVE-2026-45777 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45777 being exploited in the wild.
How severe is CVE-2026-45777?: Informational severity, with a CVSS score of 9.3, published 5 June 2026.
Which products and versions are affected?: UBCCR Open XDMoD 9.5.0 to 11.0.2.
Is there a fix for CVE-2026-45777?: A patch was published on 2026-05-12: Fixed in version 11.0.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45777 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-45777?: Check whether you run UBCCR Open XDMoD at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An OS command injection vulnerability (CWE-78) exists in Open XDMoD versions 9.5.0 through 11.0.2. The flaw allows an unauthenticated remote attacker to execute arbitrary system commands via the web interface with the privileges of the web server process. This is achieved by sending specially crafted requests that bypass input neutralization for OS commands. Successful exploitation grants the attacker full control over the application environment, including the ability to read/modify data and disrupt services. The issue is resolved in version 11.0.3, and a manual patch is available for older installations.

Affected products

ubccr Open XDMoD 9.5.0 to 11.0.2

Timeline

2026-04-06: disclosed: Reported privately
2026-05-12: patched: Fixed in version 11.0.3
2026-06-05: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.