upsmon: remote OS command injection (RCE) via attacker-controlled ups.alarm in NOTIFYCMD execution
Only upsmon setups with NOTIFYCMD and EXEC in NOTIFYFLAG for the ALARM event are affected, in NUT 2.8.3 through 2.8.5. CVSS rates it 8.1 High. No fixed release is listed.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- No fix listed
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. upsmon is configured with NOTIFYCMD and NOTIFYFLAG including EXEC for the ALARM event Affected NUT versions are 2.8.3 through 2.8.5 (and git master at time of advisory)
- Exploitation0/40No signal
- Exposure12/25Specific setups only, reachable over the network without a login
- Reach?/20Reach: unknown (data gap). No tracked technology or package matched
- Severity9.1/10CVSS 8.1, total technical impact per CISA
- No patch5/5No patch listed yet
What would change the score
- Would score about 76 if added to CISA KEV
- Would score about 71 if CISA's SSVC rates exploitation active
CVE-2026-54161 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.1 (high) and affects nut; no fixed version is listed yet.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- Published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 26/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 1 proof of concept on GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. From 2.8.3 to 2.8.5, upsmon in clients/upsmon.c inserts the server-supplied ups.alarm value into shell commands executed by notify(), async_notify(), and wall(). When a monitored device reports an ALARM state and an operator has configured NOTIFYCMD with EXEC in NOTIFYFLAG ALARM, shell metacharacters in the alarm text are evaluated on POSIX or Windows and can execute arbitrary operating-system commands as the upsmon account, which is commonly root. An attacker can control the value through a malicious or compromised upsd, a man-in-the-middle on a plaintext upsd to upsmon connection, or a compromised UPS device whose driver supplies the alarm upstream of upsd; TLS between upsd and upsmon does not mitigate the compromised-device path. This vulnerability is fixed in 2.8.6.
What to do
Check whether your setup matches what the bug needs.
upsmon is configured with NOTIFYCMD and NOTIFYFLAG including EXEC for the ALARM event Affected NUT versions are 2.8.3 through 2.8.5 (and git master at time of advisory)Workaround: Removing EXEC from NOTIFYFLAG for the ALARM event, or not using NOTIFYCMD for ALARM, removes the condition the advisory requires. The checked facts do not describe any other workaround.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- networkupstools nut
From 2.8.3 · through 2.8.5
Evidence 6
- Advisory
- Exploit
- Repository
- Repository
- Repository
- Repository
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-54161
Is CVE-2026-54161 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
An attacker-controlled ups.alarm value is passed into command execution through NOTIFYCMD. This lets arbitrary operating-system commands run as the upsmon user, commonly root, which can fully compromise the monitoring host.Source: github.com
Which versions are affected by CVE-2026-54161?
nut: from 2.8.3 through 2.8.5.Source: cve.now feed data
Am I affected, and how do I check?
NUT 2.8.3, 2.8.4, and 2.8.5, plus git master at the time of the advisory, are affected; 2.8.2 and earlier are not. The affected setup requires NOTIFYCMD with EXEC included in NOTIFYFLAG for ALARM, which can be checked in the upsmon configuration file, and the installed version can be checked with upsmon -V.Source: github.com
How do I fix CVE-2026-54161?
The checked facts do not list a fixed release, so no upgrade target can be named here. Check the vendor advisory for a release that includes the fix.Source: github.com
What if there's no patch?
Removing EXEC from NOTIFYFLAG for the ALARM event, or not using NOTIFYCMD for ALARM, removes the condition the advisory requires. The checked facts do not describe any other workaround.Source: github.com