Is CVE-2026-97863 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-97863 being exploited in the wild.

How severe is CVE-2026-97863?

Informational severity, published 25 September 2026.

Is there a fix for CVE-2026-97863?

A patch was published on 2026-09-25: Fix committed with shell-escape implementation using shlex.quote() Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-97863 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-97863?

Check whether you run Misp-Modules. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-97863: misp-modules cisco_firesight_manager_ACL_rule_export shell injection

CVE-2026-97863 · Severity: info · Published 2026-09-25

The cisco_firesight_manager_ACL_rule_export module in MISP modules generates shell scripts to interact with Cisco fireSIGHT Manager APIs. An attacker with the ability to submit MISP events containing special characters (like single quotes) can inject arbitrary shell commands into the generated scripts, which are then executed by security analysts with their own privileges. This could lead to exposure of fireSIGHT Manager credentials, unauthorized modification of firewall ACL rules, or compromise of the analyst's workstation.

Technologies: Misp-Modules. Vendors: Misp.

Quick answers

Is CVE-2026-97863 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-97863 being exploited in the wild.
How severe is CVE-2026-97863?: Informational severity, published 25 September 2026.
Which products and versions are affected?: MISP misp-modules.
Is there a fix for CVE-2026-97863?: A patch was published on 2026-09-25: Fix committed with shell-escape implementation using shlex.quote() Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-97863 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-97863?: Check whether you run Misp-Modules. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a shell command injection (CWE-78) in the export module's script generation logic. Configuration values and MISP attribute values (destination IPs, URLs, event comments) are interpolated into single-quoted shell strings without proper escaping, allowing a single-quote character in an attribute value to break the quoting context and inject arbitrary commands. The module also contains a secondary defect where the 'config' variable is conditionally assigned but unconditionally referenced, causing a NameError denial of service. Exploitation requires the ability to submit MISP events with special characters and the victim to execute the generated unmodified shell script.

Affected products

MISP misp-modules

Timeline

2026-09-25: disclosed
2026-09-25: patched: Fix committed with shell-escape implementation using shlex.quote()

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.