PatchSiren cyber security CVE debrief
CVE-2026-18996 cosmicstack-labs CVE debrief
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-06T05:16:42.087Z and has not been modified since then. The vulnerability affects cosmicstack-labs mercury-agent up to version 1.1.12, specifically the PermissionManager.checkShellCommand function, leading to incorrect privilege assignment. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet. Users of cosmicstack-labs mercury-agent up to version 1.1.12 should review and potentially update their installations. Consider compensating controls until vendor remediation is available.
- Vendor
- cosmicstack-labs
- Product
- mercury-agent
- CVSS
- LOW 2.1
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-08-06
- Original CVE updated
- 2026-08-06
- Advisory published
- 2026-08-06
- Advisory updated
- 2026-08-06
Who should care
Users of cosmicstack-labs mercury-agent up to version 1.1.12 should review and potentially update their installations. Users should review the NVD entry and CVE record for accuracy and verify affected versions and inventory for cosmicstack-labs mercury-agent. Consider compensating controls until vendor remediation is available.
Technical summary
A vulnerability in cosmicstack-labs mercury-agent up to 1.1.12 allows incorrect privilege assignment via the PermissionManager.checkShellCommand function. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet. Users should review the NVD entry and CVE record for accuracy and verify affected versions and inventory for cosmicstack-labs mercury-agent. Consider compensating controls until vendor remediation is available.
Defensive priority
Low-priority defensive review recommended due to limited details and low CVSS score.
Recommended defensive actions
- Review the CVE record and NVD entry for accuracy
- Verify affected versions and inventory for cosmicstack-labs mercury-agent
- Monitor for potential exploit attempts
- Consider compensating controls until vendor remediation is available
- Review compensating controls for exposed systems while remediation is scheduled and verified
- Check relevant monitoring, detection, and logs for exposed assets that need extra review
- Track exceptions, retest remediated assets, and close the item only after evidence is documented
Evidence notes
Evidence is limited; verify vulnerability existence and impact through primary official records and vendor statements. The CVE record was published on 2026-08-06T05:16:42.087Z and has not been modified since then. Users should review the NVD entry and CVE record for accuracy and verify affected versions and inventory for cosmicstack-labs mercury-agent. Consider compensating controls until vendor remediation is available.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-06T05:16:42.087Z and has not been modified since then.