Is CVE-2026-48687 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48687 being exploited in the wild.

How severe is CVE-2026-48687?

Informational severity, with a CVSS score of 8.1, published 26 May 2026.

Which products and versions are affected?

FastNetMon FastNetMon Community Edition through 1.2.9.

Is there a fix for CVE-2026-48687?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-48687 attacked?

It is attacked over the network or with local access, in a software library.

Am I affected by CVE-2026-48687?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48687: FastNetMon Community Edition OS command injection in Juniper plugin

CVE-2026-48687 · Severity: info · CVSS 8.1 · Published 2026-05-26

FastNetMon Community Edition, a DDoS detection and mitigation tool, contains a security flaw in its Juniper router integration plugin. This plugin is responsible for logging attack details and updating router configurations when a threat is detected. An attacker who can influence the data processed by this plugin—such as the reported attack IP address—could potentially execute arbitrary commands on the server. This could lead to a complete system takeover, unauthorized access to network hardware, or disruption of network security operations.

Quick answers

Is CVE-2026-48687 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48687 being exploited in the wild.
How severe is CVE-2026-48687?: Informational severity, with a CVSS score of 8.1, published 26 May 2026.
Which products and versions are affected?: FastNetMon FastNetMon Community Edition through 1.2.9.
Is there a fix for CVE-2026-48687?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-48687 attacked?: It is attacked over the network or with local access, in a software library.
Am I affected by CVE-2026-48687?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An OS command injection vulnerability exists in the `_log()` function within `src/juniper_plugin/fastnetmon_juniper.php`. The function constructs a shell command by concatenating unsanitized command-line arguments (`argv[1]` through `argv[3]`, representing the attack IP, direction, and power) into an `exec()` call used for logging. While the current C++ core typically passes safe dotted-decimal IP addresses, the PHP script lacks any input validation or shell escaping. An attacker can exploit this by supplying shell metacharacters (e.g., backticks or semicolons) in the input fields, leading to arbitrary command execution with the privileges of the user running the script (often root). The vulnerability can be triggered via the attack notification pipeline or direct script invocation. As of the advisory date, no official patch has been released; recommended fixes include using `file_put_contents()` or `escapeshellarg()`.

Affected products

FastNetMon FastNetMon Community Edition through 1.2.9

Timeline

2026-04-25: disclosed: Lorikeet Security notified FastNetMon LTD
2026-05-23: advisory: Lorikeet Security published detailed advisory
2026-05-26: disclosed: CVE-2026-48687 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.