Is CVE-2026-58123 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-58123 being exploited in the wild.

How severe is CVE-2026-58123?

Critical severity, with a CVSS score of 9.8, published 9 July 2026.

Which products and versions are affected?

Nesquena Hermes WebUI < 0.51.788.

Is there a fix for CVE-2026-58123?

A patch was published on 2026-06-30: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-58123 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-58123?

Check whether you run Nesquena Hermes WebUI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-58123: nesquena Hermes WebUI unauthenticated RCE in terminal API

Q: Is there a fix for CVE-2026-58123?

A patch was published on 2026-06-30: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-58123 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-58123?

Check whether you run Nesquena Hermes WebUI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-58123 · Severity: critical · CVSS 9.8 · Published 2026-07-09

Hermes WebUI, a management interface for workspace environments, contains a critical flaw in its embedded terminal feature. When the software is used without a password (the default configuration) and exposed to a network, an attacker can gain full control over the server by sending a series of web requests. This allows unauthorized individuals to execute arbitrary commands, potentially leading to complete data theft or system takeover.

Technologies: Nesquena Hermes WebUI. Vendors: Nesquena.

Quick answers

Is CVE-2026-58123 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-58123 being exploited in the wild.
How severe is CVE-2026-58123?: Critical severity, with a CVSS score of 9.8, published 9 July 2026.
Which products and versions are affected?: Nesquena Hermes WebUI < 0.51.788.
Is there a fix for CVE-2026-58123?: A patch was published on 2026-06-30: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-58123 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-58123?: Check whether you run Nesquena Hermes WebUI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing authentication check (CWE-306) in the embedded terminal API of Hermes WebUI allows unauthenticated remote code execution. The vulnerability exists because the 'check_auth()' function returns True by default when no password or passkey is configured, leaving the terminal endpoints (/api/terminal/start, /api/terminal/input, etc.) accessible to any network caller. An attacker can achieve full command execution as the server process user by making four sequential HTTP requests to initialize a session, attach a PTY shell, and input arbitrary shell commands. The issue is addressed in version 0.51.788 by implementing a local-origin gate that restricts these endpoints to loopback or private network origins when authentication is disabled.

Affected products

nesquena Hermes WebUI < 0.51.788

Timeline

2026-06-30: patched: Fix committed to repository
2026-07-01: advisory: Release v0.51.788 published
2026-07-09: disclosed: CVE-2026-58123 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.