Vulnerability · Published Oct 19, 2026 · Assigned by VulDB

CVE-2026-112371H3C Magic NX15 RPC esps write code injection

Critical 9.9

In plain English

A critical-severity code injection in Magic NX15 from H3C. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).

Severity (CVSS 3.1)9.9Critical

Exploit odds (30 days)0.5%top 54.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in H3C Magic NX15 NX15V100R017. Impacted is the function write of the file /api/esps of the component RPC Interface. Executing a manipulation of the argument path can lead to code injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.

Affected products (as reported)

Vendor	Product	Versions
H3C	Magic NX15	NX15V100R017

Weakness: CWE-94, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R

References

VDB-422417 | H3C Magic NX15 RPC esps write code injection vdb-entry, technical-description
VDB-422417 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-112371 | CVE Analysis and Report third-party-advisory
Submit #983538 | H3C Magic NX15 NX15V100R017 Code Execution third-party-advisory
https://github.com/XxingGoD/H3C-NX15-R017-Vulns/tree/main/H3C/NX15R017/file_write_root_rce exploit