Quick answers
- Is CVE-2026-82971 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-82971 being exploited in the wild.
- How severe is CVE-2026-82971?
- Critical severity, with a CVSS score of 10, published 31 August 2026.
- Which products and versions are affected?
- QVidium Opera11 3.3.2a26-Ax4x-opera11.
- Is there a fix for CVE-2026-82971?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-82971 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-82971?
- Check whether you run QVidium Opera11 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a command injection flaw in the /cgi-bin/net_tr.cgi CGI script where the ipaddr parameter is not properly sanitized before being used in a system command. An unauthenticated remote attacker can send a crafted HTTP request to the vulnerable endpoint with malicious input in the ipaddr argument to achieve arbitrary command execution with the privileges of the web server process. The attack vector is network-based and requires no authentication. Exploitation is straightforward and proof-of-concept code has been publicly disclosed. The vendor (QVidium) has ceased operations and will not release patches or provide support.
Affected products
- QVidium Opera11 3.3.2a26-Ax4x-opera11
Timeline
- 2026-08-31: disclosed
- 2026-08-31: advisory: Public disclosure announced