Vulnerability · Published Jun 19, 2026 · Assigned by NCSC.ch
CVE-2026-12104Authenticated OS Command Injection in Bondix
High 8.6
In plain English
A high-severity OS command injection in Bondix Server from SIMA GmbH. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities).
Severity (CVSS 4.0)8.6High
Exploit odds (30 days)1.3%top 29.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
OS command injection in the environment and tunnel configuration functionality in SIMA GmbH Bondix through version 1.25.7.5 on Linux allows an authenticated attacker with configuration write access to execute arbitrary operating-system commands via crafted configuration values passed to server-side scripts.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SIMA GmbH | Bondix Server | 0 – through 1.25.7.5 |
Weakness: CWE-78 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:Y/R:U/RE:L/U:Amber