Cyber Posture

CVE-2026-43944

CriticalRCE

Published: 08 May 2026

Published
08 May 2026
Modified
08 May 2026
KEV Added
Patch
CVSS Score 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
EPSS Score 0.0010 27.4th percentile
Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-43944 is a critical-severity Improper Input Validation (CWE-20) vulnerability in Electerm Project Electerm. Its CVSS base score is 9.6 (Critical).

Operationally, ranked at the 27.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-829 CWE-94

Isolated execution prevents functionality from an untrusted sphere from affecting the real environment, allowing safe behavioral inspection.

addresses: CWE-20 CWE-94

Directly implements checks on information inputs to reject invalid data before processing.

addresses: CWE-829

Limiting P2P file sharing technology reduces inclusion of functionality or resources from untrusted external control spheres.

addresses: CWE-829

Enforcing installation policies prevents users from including functionality obtained from untrusted control spheres.

addresses: CWE-829

The inventory process requires identifying and recording the origin of all components, making inclusion of functionality from untrusted control spheres easier to detect during reviews.

addresses: CWE-829

Requiring approval and monitoring of maintenance tools prevents inclusion and execution of functionality obtained from untrusted sources.

addresses: CWE-829

Unowned portable devices represent untrusted control spheres; the prohibition prevents inclusion of functionality or data from such sources.

addresses: CWE-20

Security testing and developer training directly verify and enforce proper input validation, reducing exploitability of injection and malformed-data weaknesses.

NVD Description

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. From versions 3.0.6 to before 3.8.15, electerm is vulnerable to arbitrary local code execution via deep links, CLI --opts, or crafted shortcuts. Exploit requires clicking a crafted electerm://... link or opening a crafted shortcut/command…

more

that launches electerm with attacker-controlled opts. This issue has been patched in version 3.8.15.

Deeper analysisAI

Automated synthesis unavailable for this CVE.

Details

CWE(s)

Affected Products

electerm project
electerm
3.0.6 — 3.8.15

CVEs Like This One

CVE-2026-43940Same product: Electerm Project Electerm
CVE-2026-43941Same product: Electerm Project Electerm
CVE-2026-43943Same product: Electerm Project Electerm
CVE-2026-41501Same product: Electerm Project Electerm
CVE-2026-41500Same product: Electerm Project Electerm
CVE-2026-34197Shared CWE-20, CWE-94
CVE-2026-42301Shared CWE-20, CWE-94
CVE-2025-34159Shared CWE-20, CWE-94
CVE-2026-41044Shared CWE-20, CWE-94
CVE-2026-40466Shared CWE-20, CWE-94

References