Vulnerability · Published Aug 20, 2026 · Assigned by Kaspersky

CVE-2025-14601vsDesk Task Scheduler OS Command Injection

High 8.6

In plain English

A high-severity security flaw in vsDesk from vsDesk. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities).

Severity (CVSS 4.0)8.6High

Exploit odds (30 days)1.1%top 35.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An OS command injection vulnerability in vsDesk allows an authenticated attacker with administrative privileges to execute arbitrary operating system commands due to insufficient input filtering. An attacker can exploit this flaw to disrupt web server operations, expose sensitive data, or potentially achieve full server compromise. Apply patch from vendor https://vsdesk.ru/ . Versions 14.0101 and on have the patch.

Affected products (as reported)

Vendor	Product	Versions
vsDesk	vsDesk	11.06.02

Weakness: CWE-676 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://github.com/klsecservices/Advisories/blob/master/KLSA-00343-vsDesk-Task-Scheduler-OS-Command-Injection.md