CVE-2026-34176: High-Severity Command Injection in iControl REST Endpoint

The National Vulnerability Database has disclosed CVE-2026-34176, a high-severity command injection vulnerability impacting an undisclosed iControl REST endpoint when operating in Appliance mode. This flaw, rated with a CVSS score of 8.7 (HIGH), allows an authenticated remote attacker to execute arbitrary commands, effectively bypassing security boundaries.

The core issue, categorized as CWE-78 (Improper Neutralization of Special Elements used in a Command), highlights a critical risk. An attacker with existing authentication could leverage this to gain deeper access or control, pivoting within the environment. The National Vulnerability Database notes that software versions that have reached End of Technical Support (EoTS) are not evaluated for this vulnerability, implying that older, unpatched systems may be at even greater risk.

While specific affected products are not detailed by the National Vulnerability Database, organizations utilizing devices with iControl REST endpoints in Appliance mode must assume they are vulnerable. The requirement for prior authentication does not diminish the severity; it merely shifts the attacker’s calculus towards credential compromise or insider threat scenarios.