← Vulnerability feed

Vulnerability record · CVE-2018-11139 · published 31 May 2018

CVE-2018-11139: Quest kace system management appliance os command injection vulnerability

Quest · Kace System Management Appliance

The '/common/ajax_email_connection_test.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by any authenticated user and can be abused to execute arbitrary commands on the system. This script is vulnerable to command injection via the unsanitized user input 'TEST_SERVER' sent to the script via the POST method.

8.8 CVSS 3.0 High EPSS 43% · top 1.3% CWE-78 · OS command injection
8.8CVSS 3.0 base score, v2 9.0
43%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

The '/common/ajax_email_connection_test.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by any authenticated user and can be abused to execute arbitrary commands on the system. This script is vulnerable to command injection via the unsanitized user input 'TEST_SERVER' sent to the script via the POST method.

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.coresecurity.com/advisories/quest-kace-system-management-appliance-multiple-vulnerabilities ExploitTechnical DescriptionThird Party Advisory
https://www.coresecurity.com/advisories/quest-kace-system-management-appliance-multiple-vulnerabilities ExploitTechnical DescriptionThird Party Advisory

Track CVE-2018-11139 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2018-11138Quest KACE System Management Appliance unauthenticated OS command injectionThe download_agent_installer.php script in Quest KACE System Management Appliance 8.0.318 is reachable by anonymous users and passes input to the ope…KEVEPSS 92%analysed9.8CVE-2018-11136Quest kace system management appliance sql injection vulnerabilityThe 'orgID' parameter received by the '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is not sani…EPSS 1.4%9.8CVE-2018-11140Quest kace system management appliance sql injection vulnerabilityThe 'reportID' parameter received by the '/common/run_report.php' script in the Quest KACE System Management Appliance 8.0.318 is not sanitized, lead…EPSS 1.4%9.8CVE-2018-11141Quest kace system management appliance path traversal vulnerabilityThe 'IMAGES_JSON' and 'attachments_to_remove[]' parameters of the '/adminui/advisory.php' script in the Quest KACE System Management Virtual Applianc…EPSS 2.0%8.8CVE-2018-11132Quest kace system management appliance os command injection vulnerabilityIn order to perform actions that require higher privileges, the Quest KACE System Management Appliance 8.0.318 relies on a message queue that runs da…EPSS 18%8.8CVE-2018-11134Quest kace system management appliance weak password recovery vulnerabilityIn order to perform actions that requires higher privileges, the Quest KACE System Management Appliance 8.0.318 relies on a message queue managed tha…EPSS 3.0%8.8CVE-2018-11135Quest kace system management appliance prototype pollution vulnerabilityThe script '/adminui/error_details.php' in the Quest KACE System Management Appliance 8.0.318 allows authenticated users to conduct PHP object inject…EPSS 2.1%6.5CVE-2018-11137Quest kace system management appliance path traversal vulnerabilityThe 'checksum' parameter of the '/common/download_attachment.php' script in the Quest KACE System Management Appliance 8.0.318 can be abused to read …EPSS 6.5%

Source: NIST National Vulnerability Database (record CVE-2018-11139), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.