Cyber Posture

CVE-2026-27476

CriticalPublic PoC

Published: 19 February 2026

Published
19 February 2026
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0039 60.0th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

RustFly 2.0.0 contains a command injection vulnerability in its remote UI control mechanism that accepts hex-encoded instructions over UDP port 5005 without proper sanitization. Attackers can send crafted hex-encoded payloads containing system commands to execute arbitrary operations on the target…

more

system, including reverse shell establishment and command execution.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly mandates validation of hex-encoded inputs received over UDP port 5005 to prevent command injection exploits.

SI-2 Flaw Remediation good match
prevent

Requires timely remediation of the specific sanitization flaw in RustFly 2.0.0 via patching or upgrades.

SC-7 Boundary Protection good match
prevent

Enforces boundary protections such as firewalls to block unauthorized inbound traffic to the exposed UDP port 5005.

Security SummaryAI

CVE-2026-27476 is a command injection vulnerability (CWE-78) in RustFly 2.0.0, published on 2026-02-19. The flaw exists in the software's remote UI control mechanism, which accepts hex-encoded instructions over UDP port 5005 without proper sanitization. This critical issue carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), highlighting its potential for severe impact.

Remote, unauthenticated attackers can exploit the vulnerability by sending crafted hex-encoded payloads to UDP port 5005 on affected systems. No privileges or user interaction are required, enabling network-based attacks with low complexity. Successful exploitation grants arbitrary command execution on the target system, including reverse shell establishment and other malicious operations.

Mitigation guidance is available in related advisories, including those from VulnCheck at https://www.vulncheck.com/advisories/rustfly-command-injection-via-udp-remote-control and PacketStorm at https://packetstorm.news/files/id/215819/.

Details

CWE(s)
CWE-78

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059 Command and Scripting Interpreter Execution
Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.
attack.mitre.org →
Why these techniques?

CVE enables remote unauthenticated command injection via UDP service, directly facilitating T1190 (Exploit Public-Facing Application) for initial access and T1059 (Command and Scripting Interpreter) for arbitrary command execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References