CVE-2026-18901: H3C NX15 Web API esps service.add routine

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-05 · updated 2026-10-23
Weakness: CWE-749

Description

A security vulnerability has been detected in H3C NX15 V100R017. Affected is the function service.add of the file /api/esps of the component Web API. Such manipulation leads to exposed dangerous routine. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.

Affected products

H3C NX15: V100R017

References

https://github.com/coconut652-7/IOT_Vul_Public/blob/main/H3C/NX15R017/service_add_root_rce_chain/poc/postauth_service_add_rce.py
https://github.com/coconut652-7/IOT_Vul_Public/tree/main/H3C/NX15R017/service_add_root_rce_chain/report
https://vuldb.com/cve/CVE-2026-18901
https://vuldb.com/submit/857817
https://vuldb.com/vuln/385935
https://vuldb.com/vuln/385935/cti

Get alerted when CVE-2026-18901 or the next vulnerability affects your stack