# CVE-2026-45777: ubccr Open XDMoD OS command injection

Source: https://junglewise.ai/threats/cve-2026-45777-ubccr-open-xdmod-os-command-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-05. Updated: 2026-06-05  
License: CC BY 4.0 with a link back

CVE-2026-45777 · Severity: info · CVSS 9.3 · Published 2026-06-05

Open XDMoD, a tool used to analyze performance metrics for high-performance computing (HPC) clusters, contains a critical security flaw. An unauthorized attacker can remotely take control of the web server hosting the application. This could lead to the theft of sensitive research data, unauthorized modification of system settings, or a complete shutdown of the monitoring service.

Technologies: [UBCCR Open XDMoD](https://junglewise.ai/threats/technologies/open-xdmod). Vendors: [UBCCR](https://junglewise.ai/threats/vendors/ubccr).

## Quick answers

**Is CVE-2026-45777 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45777 being exploited in the wild.

**How severe is CVE-2026-45777?** Informational severity, with a CVSS score of 9.3, published 5 June 2026.

**Which products and versions are affected?** UBCCR Open XDMoD 9.5.0 to 11.0.2.

**Is there a fix for CVE-2026-45777?** A patch was published on 2026-05-12: Fixed in version 11.0.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45777 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-45777?** Check whether you run UBCCR Open XDMoD at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An OS command injection vulnerability (CWE-78) exists in Open XDMoD versions 9.5.0 through 11.0.2. The flaw allows an unauthenticated remote attacker to execute arbitrary system commands via the web interface with the privileges of the web server process. This is achieved by sending specially crafted requests that bypass input neutralization for OS commands. Successful exploitation grants the attacker full control over the application environment, including the ability to read/modify data and disrupt services. The issue is resolved in version 11.0.3, and a manual patch is available for older installations.

## Affected products

- ubccr Open XDMoD 9.5.0 to 11.0.2

## Timeline

- 2026-04-06: disclosed: Reported privately
- 2026-05-12: patched: Fixed in version 11.0.3
- 2026-06-05: advisory: NVD publication date

## References

- [https://github.com/ubccr/xdmod/releases/tag/v11.0.3-2](https://github.com/ubccr/xdmod/releases/tag/v11.0.3-2)
- [https://github.com/ubccr/xdmod/security/advisories/GHSA-29qm-7w4v-43fw](https://github.com/ubccr/xdmod/security/advisories/GHSA-29qm-7w4v-43fw)
- [https://open.xdmod.org/security_patches/GHSA-29qm-7w4v-43fw-9_5_0-11_0_2.patch](https://open.xdmod.org/security_patches/GHSA-29qm-7w4v-43fw-9_5_0-11_0_2.patch)

## Related threats

- [ubccr Open XDMoD SQL injection in Metric Explorer](https://junglewise.ai/threats/cve-2026-45779-ubccr-open-xdmod-sql-injection-in-metric-explorer)
- [Open XDMoD reflected XSS in password reset functionality](https://junglewise.ai/threats/cve-2026-45778-open-xdmod-reflected-xss-in-password-reset-functionality)
- [Open XDMoD broken access control in SUPReMM module](https://junglewise.ai/threats/cve-2026-45776-open-xdmod-broken-access-control-in-supremm-module)