Critical OmniRoute Flaw Enables Unauthenticated Code Execution via PoC

CVE-2026-88062 has been disclosed for OmniRoute, with a CVSS score of 9.5, describing a remote code execution flaw that allows attackers to run arbitrary commands without authentication. The vulnerability affects OmniRoute installations running versions earlier than 3.8.49. A public proof-of-concept (PoC) exploit has been released, and a vendor advisory notes the severity and the need for remediation. At the time of reporting, there is no confirmed exploitation in the wild, but the PoC exists and defenders should treat the flaw as critical.

Mechanism and impact: the issue lies in OmniRoute’s custom agent registration endpoint. An attacker can send a crafted HTTP request that manipulates binary and version command parameters, bypassing input sanitisation and causing the server to execute attacker-supplied JavaScript inside the server container. This effectively grants the attacker the ability to execute operating-system commands, potentially leading to a full server compromise, access to API keys, and movement within internal networks.

Evidence cited includes the PoC exploit and the official OmniRoute security advisory. Practical response emphasises upgrading to version 3.8.49 or later immediately. If patching cannot be immediate, securing the management interface with a strong password, enabling login requirements, and restricting network access to trusted hosts via strict firewall rules are advised as interim mitigations.