Is CVE-2026-73226 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-73226 being exploited in the wild.

How severe is CVE-2026-73226?

High severity, with a CVSS score of 8.8, published 11 August 2026.

Which products and versions are affected?

electerm electerm prior to 3.15.186.

Is there a fix for CVE-2026-73226?

A patch was published on 2026-07-28: Fix merged in commit b1729eb Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-73226 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-73226?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-73226: electerm authenticated method invocation vulnerability

CVE-2026-73226 · Severity: high · CVSS 8.8 · Published 2026-08-11

electerm is an open-source terminal and file transfer client that supports multiple protocols including SSH, SFTP, and VNC. Prior to version 3.15.186, authenticated users connecting via WebSocket could invoke internal functions that should not be exposed, allowing them to execute arbitrary commands, access or modify files, or crash the application. This could enable a compromised or malicious user account to take full control of the system running electerm.

Quick answers

Is CVE-2026-73226 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-73226 being exploited in the wild.
How severe is CVE-2026-73226?: High severity, with a CVSS score of 8.8, published 11 August 2026.
Which products and versions are affected?: electerm electerm prior to 3.15.186.
Is there a fix for CVE-2026-73226?: A patch was published on 2026-07-28: Fix merged in commit b1729eb Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-73226 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-73226?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a privilege escalation and unintended function exposure issue in electerm's WebSocket dispatch mechanism. The vulnerable code in dispatch-center.js and fs.js fails to validate which internal methods can be invoked by authenticated WebSocket clients, allowing attackers to call unintended functions like Upgrade and fsExport. An authenticated attacker can exploit this to execute commands, open arbitrary files, mutate the filesystem, or terminate the process. The fix, released in version 3.15.186, adds proper validation of dispatched method names to restrict access to only intended functions.

Affected products

electerm electerm prior to 3.15.186

Timeline

2026-08-11: disclosed
2026-07-28: patched: Fix merged in commit b1729eb

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.