OS command injection in SoftIron HyperCloud Orchestrator via VM template fields
Key facts
- Attack vector
- Adjacent network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-78.
Summary
SoftIron HyperCloud Orchestrator from 1.0 before 2.6.18 contains an OS command injection flaw (CWE-78). Virtual machine template content, such as the VM DESCRIPTION field, is passed to hosts through a shell here-document with an unquoted terminator, so shell expansion and terminator injection run on that content. An authenticated user with access to the management plane and valid credentials can execute arbitrary operating system commands on hypervisor hosts as the privileged orchestration user, when a deploy, migrate or network setup operation reaches the affected host.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
Description from the CNA
Improper Neutralization of Special Elements used in a Command ('Command Injection') in the Orchestrator component of SoftIron HyperCloud allows an authenticated user with access to the management plane to execute arbitrary operating system commands on hypervisor hosts as the privileged orchestration user. Attacker-controlled virtual machine template content (for example, the VM DESCRIPTION field) is delivered to hosts through a shell here-document whose terminator is not quoted, so shell expansion and here-document terminator injection are performed on that content during virtual machine lifecycle operations such as deploy, migrate, and network setup. Exploitation requires valid credentials, access to the management plane (owning a virtual machine alone is not sufficient), and a lifecycle operation that reaches the affected host. This issue affects the Orchestrator component of SoftIron HyperCloud from 1.0 through 2.6.17 and is fixed in 2.6.18.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Upgrade SoftIron HyperCloud to version 2.6.18, which fixes this issue. CISA does not list this vulnerability in its Known Exploited Vulnerabilities catalog.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
- Fix · CNA HyperCloud (SoftIron) Fixed in 2.6.18
Timeline
- 2026-10-31 Threatist record created from CVE-2026-116755
- 2026-10-31 Alias added: GHSA-qhpq-4pf4-cqxv
- 2026-11-01 Priority changed: MEDIUM → LOW
- 2026-11-06 CISA SSVC decision points changed
References
More SoftIron vulnerabilities
- TI-2023-24129 Media caddy removal and reinsertion without reboot may cause data loss CVSS 3.1HIGH 7.0
- TI-2026-01517 HyperCloud Improper Refresh Token Validation and Access Token Invalidation Allows Long-Term Unauthorized Access CVSS 4.0MEDIUM 6.2
- TI-2024-12106 Authenticated, non-admin users can create storage pools via the sifi API CVSS 4.0MEDIUM 4.8
- TI-2023-24128 HyperCloud: "admin" and "serveradmin" users can be deleted CVSS 3.1MEDIUM 4.4
- TI-2023-24130 When compute hosts are disabled and reenabled, they immediately transition to "ON", not "INIT" CVSS 3.1LOW 3.3
- TI-2025-09750 Improper SSH Key Handling in Internal Debug Builds May Grant Cluster-Level Access to Non-Administrative Users CVSS 4.0LOW 1.8
Sources
- CVE-2026-116755 · CVE Program
- CVE-2026-116755 · NVD
- FIRST EPSS
- GHSA-qhpq-4pf4-cqxv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences