CVE-2026-3943
Last modified
CVE-2026-3943 is a high-severity vulnerability rated 7.3/10 on the CVSS scale. A vulnerability was found in H3C ACG1000-AK230 up to 20260227. This affects an unknown part of the file /webui/?aaa_portal_auth_local_submit. EPSS estimates a 40.80% chance of exploitation in the next 30 days.
Description
A vulnerability was found in H3C ACG1000-AK230 up to 20260227. This affects an unknown part of the file /webui/?aaa_portal_auth_local_submit. The manipulation of the argument suffix results in command injection. The attack can be launched remotely. The exploit has been made public and could be used. The vendor is investigating and remediating this issue.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-3943?
How severe is CVE-2026-3943?
How do I fix CVE-2026-3943?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-39423MaxKB is an open-source AI assistant for enterprise. Version…5.4
- CVE-2026-39424MaxKB is an open-source AI assistant for enterprise. In vers…4.7
- CVE-2026-39425MaxKB is an open-source AI assistant for enterprise. Version…5.4
- CVE-2026-39426MaxKB is an open-source AI assistant for enterprise. Version…5.4
- CVE-2026-39428CubeCart is an ecommerce software solution. Prior to 6.6.0, …4.8
- CVE-2026-39429kcp is a Kubernetes-like control plane for form-factors and …9.1
- CVE-2026-39432Missing Authorization vulnerability in Arraytics Timetics al…8.2
- CVE-2026-39433Subscriber Arbitrary Content Deletion in WPAMS < 49.5.3 vers…6.5
- CVE-2026-39434Shop manager PHP Object Injection in CTX Feed <= 6.6.26 vers…7.2
- CVE-2026-39435Unauthenticated Cross Site Scripting (XSS) in CformsII <= 15…7.1
- CVE-2026-39436Cross-Site Request Forgery (CSRF) vulnerability in bgermann …7.1
- CVE-2026-39437Unauthenticated Cross Site Scripting (XSS) in Min Max Step Q…7.1
Are you affected by CVE-2026-3943?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST