Is CVE-2026-8652 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-8652 being exploited in the wild.

How severe is CVE-2026-8652?

Informational severity, with a CVSS score of 8.5, published 25 May 2026.

Is there a fix for CVE-2026-8652?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-8652 attacked?

It is attacked from the adjacent network, in a network appliance.

Am I affected by CVE-2026-8652?

Check whether you run Nec Aterm. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8652: NEC Aterm OS command injection in web console

CVE-2026-8652 · Severity: info · CVSS 8.5 · Published 2026-05-25

NEC Aterm networking devices contain a security flaw that allows an attacker to take full control of the underlying operating system. To exploit this, an attacker must first gain administrative access to the device's web management console. Once logged in, they can execute unauthorized commands, potentially leading to data interception, network disruption, or further attacks on the local network.

Vendors: Nec.

Quick answers

Is CVE-2026-8652 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-8652 being exploited in the wild.
How severe is CVE-2026-8652?: Informational severity, with a CVSS score of 8.5, published 25 May 2026.
Which products and versions are affected?: NEC Aterm.
Is there a fix for CVE-2026-8652?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-8652 attacked?: It is attacked from the adjacent network, in a network appliance.
Am I affected by CVE-2026-8652?: Check whether you run Nec Aterm. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An OS command injection vulnerability (CWE-78) exists within the web-based management console of NEC Aterm devices. The flaw is triggered when the application fails to properly neutralize special elements used in OS commands. An attacker with high privileges (administrator access) can exploit this vulnerability over an adjacent network to execute arbitrary system commands. This could result in a complete compromise of the device's integrity, availability, and confidentiality. The vulnerability was reported by NEC Corporation with a CVSS 4.0 score of 8.5.

Affected products

NEC Aterm

Timeline

2026-05-25: disclosed: Initial publication of CVE-2026-8652 by NEC Corporation.

References

https://jpn.nec.com/security-info/secinfo/nv26-003_en.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.