Vulnerability · Published Feb 11, 2026 · Assigned by MHV

CVE-2026-2249Unauthenticated Remote Command Execution via Web Console in METIS DFS

Critical 9.8

In plain English

A critical-severity missing authentication in METIS DFS from METIS Cyberspace Technology SA. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.6%top 51.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

METIS DFS devices (versions <= oscore 2.1.234-r18) expose a web-based shell at the /console endpoint that does not require authentication. Accessing this endpoint allows a remote attacker to execute arbitrary operating system commands with 'daemon' privileges. This results in the compromise of the software, granting unauthorized access to modify configuration, read and alter sensitive data, or disrupt services.

Affected products (as reported)

Vendor	Product	Versions
METIS Cyberspace Technology SA	METIS DFS	oscore 2.1.234-r18

Weakness: CWE-306, CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://www.metis.tech/ x_vendor-website
https://cydome.io/vulnerability-advisory-cve-2026-2249-unauthenticated-rce-in-metis-data-fusion-server-dfs technical-description