CVE-2026-112159 JumpServer CVE debrief

Who should care

Defenders responsible for JumpServer instances should assess exposure and prioritize upgrading to version 5.0.0 or applying the patch fcf2904cdb884230e9676f50f37a44d09fa97040. Security teams and vulnerability management teams should review the vulnerability details and plan for necessary updates or mitigations. Operators of JumpServer instances should verify their deployments and ensure they are running a version that is not vulnerable. Platform owners and

Why it matters

CVE-2026-112159 is an OS command injection vulnerability in JumpServer that can be exploited remotely. Defenders should verify exposure and prioritize upgrading or patching.

• Verify exposure of JumpServer instances to potential OS command injection
• Prioritize upgrading to version 5.0.0 or applying patch fcf2904cdb884230e9676f50f37a44d09fa97040
• Monitor for potential exploitation attempts

Technical summary

The vulnerability is in the template rendering component of JumpServer up to 4.10.19. The IP/HOST argument can be manipulated to inject OS commands, allowing for remote exploitation. This issue is fixed in version 5.0.0. The exploit has been publicly disclosed, increasing the risk of exploitation. Defenders should assess exposure and prioritize upgrading or patching to mitigate potential damage. The affected component should be upgraded as soon as possible to prevent unauthorized command execution. The vendor confirms the issue was identified and fixed in version 5.0.0.

Defensive priority

Defenders should prioritize verifying exposure of JumpServer instances and upgrading to version 5.0.0 or applying the patch fcf2904cdb884230e9676f50f37a44d09fa97040.

Recommended defensive actions

• Verify exposure of JumpServer instances
• Upgrade to version 5.0.0
• Apply patch fcf2904cdb884230e9676f50f37a44d09fa97040
• Review compensating controls for exposed systems
• Monitor for potential exploitation attempts
• Track exceptions and retest remediated assets
• Check relevant monitoring, detection, and logs for exposed assets

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, confirming it was identified and fixed in version 5.0.0. Public exploit disclosure has occurred, emphasizing the need for defenders to verify exposure and prioritize upgrading or patching. The vendor confirms the issue was identified quite some time ago and has already been fixed in the v5 branch, with the fix also included in an upcoming v4 release.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.