CVE-2026-97863 misp CVE debrief

Who should care

Security analysts and administrators who use the misp-modules and execute exported scripts should assess their exposure and take steps to prevent exploitation. Additionally, operators and platform administrators who manage fireSIGHT Manager systems, vulnerability management teams who track and remediate vulnerabilities, and security teams who monitor for suspicious activity should also be aware of this vulnerability and its potential impacts.

Why it matters

The vulnerability allows an attacker to inject arbitrary shell commands into an exported script, potentially leading to exposure of sensitive credentials, modification of ACL rules, or compromise of the analyst workstation. Security analysts and administrators should assess their exposure and take steps to prevent exploitation.

• Potential exposure of fireSIGHT Manager credentials
• Possible modification of ACL rules
• Potential compromise of the analyst workstation
• Verification of script execution privileges and MISP event submission controls

Technical summary

The cisco_firesight_manager_ACL_rule_export module in misp-modules generates a shell script (.sh) that authenticates to and calls the Cisco fireSIGHT Manager API. The module interpolates configuration values (IP address, login, password, domain ID, policy ID) and MISP attribute values (destination IPs, URLs, event info comments) directly into single-quoted shell string assignments without any escaping or sanitization.

Defensive priority

High

Recommended defensive actions

• Review and update the cisco_firesight_manager_ACL_rule_export module to properly escape and sanitize configuration values and MISP attribute values.
• Restrict access to the exported script to prevent unauthorized execution.
• Monitor for suspicious activity related to MISP event submissions and script execution.
• Perform a thorough review of the system to identify potential exposure of fireSIGHT Manager credentials.
• Verify that the script execution privileges and MISP event submission controls are properly configured.
• Conduct a security audit to identify potential vulnerabilities in the analyst workstation.
• Implement additional security measures to prevent exploitation of the vulnerability.

Evidence notes

The vulnerability requires the attacker to have the ability to submit MISP events or attributes containing a single-quote character and the victim to execute the exported script. No authentication bypass is required beyond standard MISP event-submission privileges.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.