CVE-2026-12195

EUVD-2026-41665
myVesta is affected by an authenticated remote code execution vulnerability. Low privileged users can insert arbitrary commands as a part of the v_ftp_user parameter when deleting FTP usernames. This could result in the execution of commands as the admin user or takevoer of the admin user in myVesta.
OS Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
UNKNOWN
---
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 46%
Common Weakness Enumeration
References
https://github.com/myvesta/vesta/commit/95d7e43bf286d6881ca753dac93cb42d98cc7422
https://projectblack.io/blog/local-ai-for-cyber-security/#myvesta-authenticated-rce