Vulnerability · Published Aug 21, 2026 · Assigned by ZUSO ART
CVE-2026-76156Datiphy Data Management Center - Improper Neutralization of Special Elements used in an OS Command
Critical 9.4
In plain English
A critical-severity OS command injection in Data Management Center from Datiphy Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities).
Severity (CVSS 4.0)9.4Critical
Exploit odds (30 days)1.1%top 34.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
OS command injection in the api endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an authenticated administrator to execute arbitrary operating system commands as root.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Datiphy Inc. | Data Management Center | v8.3.0 – through v8.5.1 |
Weakness: CWE-78 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
References
- https://zuso.ai/advisory third-party-advisory