CVE-2026-97863

What it is

The cisco_firesight_manager_ACL_rule_export module in misp-modules generates a shell script (.sh) that authenticates to and calls the Cisco fireSIGHT Manager API. The module interpolates configuration values (IP address, login, password, domain ID, policy ID) and MISP attribute values (destination IPs, URLs, event info comments) directly into single-quoted shell string assignments without any escaping or sanitization. Because the values are placed inside single-quoted shell strings, any value containing a single-quote character (e.g., a crafted ip-dst or url attribute value submitted to MISP) breaks out of the quoting context, allowing an attacker to inject arbitrary shell commands into the exported script. A security analyst who subsequently executes the generated .sh file unmodified would run the injected commands with their own privileges, potentially exposing fireSIGHT Manager credentials, modifying ACL rules, or compromising the analyst workstation. Additionally, the module contained a secondary defect where the variable 'config' was only assigned inside a conditional block but referenced unconditionally afterward, causing a NameError (denial of service) when the request payload lacked a 'config' key. The vulnerability requires the attacker to have the ability to submit MISP events or attributes containing a single-quote character and the victim to execute the exported script. No authentication bypass is required beyond standard MISP event-submission privileges.

At a glance

Exploitability

Can be exploited over the network with a low-privilege account, but needs a user to act. Limited direct impact.

Exploit odds

0.3% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-09-25 09:17 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-09-25 14:31 UTC Last updatedMost recent change to the record

Details

Published

2026-09-25 09:17 UTC

Last modified

2026-09-25 14:31 UTC

Exploit probability

0.3% · EPSS, next 30 days

Weakness

CWE-78 · OS command injection

Record status

Deferred

Attack profile CVSS 4.0 · 6.3

Attack vector

Network

Complexity

Low

Attack requirements

None

Privileges needed

Low

User interaction

Active

Confidentiality

None

Integrity

None

Availability

None