Vulnerability · Published Feb 19, 2026 · Assigned by VulnCheck
CVE-2026-27476RustFly 2.0.0 Command Injection via UDP Remote Control
Critical 9.8
In plain English
A critical-severity OS command injection in RustFly from Bixat. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 3.0% (higher than 87% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)3.0%top 12.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
RustFly 2.0.0 contains a command injection vulnerability in its remote UI control mechanism that accepts hex-encoded instructions over UDP port 5005 without proper sanitization. Attackers can send crafted hex-encoded payloads containing system commands to execute arbitrary operations on the target system, including reverse shell establishment and command execution.
Affected products (as reported)
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- PacketStorm-215819 exploit
- VulnCheck Advisory: RustFly 2.0.0 Command Injection via UDP Remote Control third-party-advisory