Vulnerability · Published Sep 2, 2026 · Assigned by VulDB
CVE-2026-84887simular-ai Agent-S Model-generated GUI Action Execution Workflow grounding.py denial of service
Medium 4.3
In plain English
A medium-severity security flaw in Agent-S from simular-ai. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).
Official description
A vulnerability was identified in simular-ai Agent-S up to 0.3.2. Affected by this issue is some unknown functionality of the file grounding.py of the component Model-generated GUI Action Execution Workflow. The manipulation leads to denial of service. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| simular-ai | Agent-S | 0.3.00.3.10.3.2 |
Weakness: CWE-404 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R
References
- VDB-398136 | simular-ai Agent-S Model-generated GUI Action Execution Workflow grounding.py denial of service vdb-entry
- VDB-398136 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- CVE-2026-84887 | CVE Analysis and Report third-party-advisory
- Submit #886451 | Simular AI Agent-S 0.3.2 Denial of Service third-party-advisory
- https://github.com/outlookgp/CVE/tree/main/AgentS_Action_Parameter_Budget_DoS_Report exploit