Cellopoint｜CelloOS - Improper Access Control
Priority MEDIUM 40CWE-1284Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
The SSH service of CelloOS developed by Cellopoint has an Improper Access Control vulnerability, allowing authenticated remote attackers to bypass the enforced command restrictions and execute operating system commands outside the originally authorized scope.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0045 39th percentileScored 2026-11-07
Fix Fixed CelloOS (Cellopoint): 4.8.0 Build 20260316
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Cellopoint | CelloOS | before 4.8.0 Build 20260316 | 4.8.0 Build 20260316 | Patch available | CNA |
- CelloOS VendorCellopoint Affected before 4.8.0 Build 20260316 Fixed in 4.8.0 Build 20260316 Patch available CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:cellopoint:cellos:*:*:*:*:*:*:*:* | — | — | Cellopoint |
- cpe:2.3:o:cellopoint:cellos:*:*:*:*:*:*:*:* Versions — — ·Cellopoint
Remediation
- Fix · CNA CelloOS (Cellopoint) Fixed in 4.8.0 Build 20260316
Timeline
- 2026-10-02 Threatist record created from CVE-2026-12059
- 2026-10-03 Alias added: GHSA-qg44-88jp-h8xv
References
More Cellopoint vulnerabilities
- TI-2024-06251 Stack-based buffer overflow in Cellopoint Secure Email Gateway CVSS 3.1CRITICAL 9.8
- TI-2024-08396 Cellopoint Secure Email Gateway - Buffer Overflow CVSS 3.1CRITICAL 9.8
- TI-2020-13151 Cellopoint CelloOS - Unauthenticated Arbitrary File Disclosure CVSS 3.1HIGH 7.5
- TI-2020-13150 Cellopoint CelloOS - Remote Command Execution (RCE) CVSS 3.1HIGH 7.2
- TI-2020-13152 Cellopoint CelloOS - Server-Side Request Forgery (SSRF) CVSS 3.1MEDIUM 6.5
Sources
- CVE-2026-12059 · CVE Program
- CVE-2026-12059 · NVD
- FIRST EPSS
- GHSA-qg44-88jp-h8xv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences