securityonline.info 11 Sept 2026, 08:29 UTC

Critical OmniRoute Flaw Enables Unauthenticated Code Execution via PoC

Critical OmniRoute Flaw Enables Unauthenticated Code Execution via PoC
CyberSIXT Evidence Panel Source marked as original reporting
CISA KEV Not in KEV
Patch Patch Status Unknown

CVE- 2026-88062 has been disclosed for OmniRoute, with a CVSS score of 9.5, describing a remote code execution flaw that allows attackers to run arbitrary commands without authentication. The vulnerability affects OmniRoute installations running versions earlier than 3.8.49. A public proof-of-concept (PoC) exploit has been released, and a vendor advisory notes the severity and the need for remediation. At the time of reporting, there is no confirmed exploitation in the wild, but the PoC exists and defenders should treat the flaw as critical.

Mechanism and impact: the issue lies in OmniRoute’s custom agent registration endpoint. An attacker can send a crafted HTTP request that manipulates binary and version command parameters, bypassing input sanitisation and causing the server to execute attacker-supplied JavaScript inside the server container. This effectively grants the attacker the ability to execute operating-system commands, potentially leading to a full server compromise, access to API keys, and movement within internal networks.

Evidence cited includes the PoC exploit and the official OmniRoute security advisory. Practical response emphasises upgrading to version 3.8.49 or later immediately. If patching cannot be immediate, securing the management interface with a strong password, enabling login requirements, and restricting network access to trusted hosts via strict firewall rules are advised as interim mitigations.

View full article

Article by CyberSIXT