CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-86124 — AutoAgent contains an unauthenticated remote code execution vulnerability in the...

·Source: NIST NVD

Updated:

Executive Summary

AutoAgent contains an unauthenticated remote code execution vulnerability in the TCP server that binds to all interfaces and executes attacker-supplied commands as root. Attackers can connect to the exposed communication port and execute arbitrary bash commands within the container, gaining access to bind-mounted host workspace directories.

Analysis

AutoAgent contains an unauthenticated remote code execution vulnerability in the TCP server that binds to all interfaces and executes attacker-supplied commands as root. Attackers can connect to the exposed communication port and execute arbitrary bash commands within the container, gaining access to bind-mounted host workspace directories. CVSS Score: 9.8. Published: 2026-09-05T10:16:43.900.

Indicators of Compromise (1)

CVE (1)
CVE-2026-86124
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Sep 5, 2026. Verified by: NIST.

Related Threats

CRITICALVulnerability

Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials

JetBrains is urging Cadence users to revoke and rotate all credentials following a security incident last month in which unidentified threat actors exploited a recently disclosed critical vulnerability in TeamCity to breach its own environment. "Cadence users should immediately revoke or rotate all credentials and secrets that may have been used to run their Cadence executions," JetBrains said.

The Hacker News
CRITICALVulnerability

Critical VMware Workstation and Fusion Flaw Lets VM Admins Execute Host Code

Broadcom has released security updates for two security flaws impacting VMware Workstation and Fusion, including one critical bug that could result in arbitrary code execution under certain conditions. The vulnerability, tracked as CVE-2026-59346 (CVSS score: 9.3), is an integer-overflow vulnerability that a local attacker with elevated privileges can exploit to run arbitrary code. "A

CVE-2026-59346
The Hacker News
MEDIUMVulnerability

Over 5,400 hacked sites serve ClickFix payloads stored on the blockchain

A massive cybercriminal operation is leveraging thousands of compromised small-business websites to deliver ClickFix payloads stored in smart contracts on the BNB Smart Chain (BSC). [...]

BleepingComputer