← Vulnerability feed

Vulnerability record · CVE-2018-6961 · published 11 June 2018

CVE-2018-6961: VMware NSX SD-WAN Edge local web UI command injection

Vmware · Nsx Sd Wan By Velocloud

VMware NSX SD-WAN Edge by VeloCloud before version 3.1.0 contains an OS command injection flaw (CWE-78) in its local web UI component. The component is disabled by default and VMware advises against enabling it on untrusted networks, but when reachable it allows remote code execution. It matters because the flaw is confirmed exploited in the wild and carries a very high EPSS probability.

8.1 CVSS 3.1 High CISA KEV since 25 Mar 2022 EPSS 86% · top 0.3% CWE-78 · OS command injection
8.1CVSS 3.1 base score, v2 6.8
86%EPSS exploitation probability, 30 days
YesIn CISA KEV, fix deadline passed
1Affected product versions listed by NVD
9References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

VMware NSX SD-WAN Edge by VeloCloud prior to version 3.1.0 contains a command injection vulnerability in the local web UI component. This component is disabled by default and should not be enabled on untrusted networks. VeloCloud by VMware will be removing this service from the product in future releases. Successful exploitation of this issue could result in remote code execution.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityConfirmed exploitation (CISA KEV) combined with a very high EPSS score and remote code execution impact warrants urgent remediation despite the service being disabled by default.

What it is

VMware NSX SD-WAN Edge by VeloCloud before version 3.1.0 contains an OS command injection flaw (CWE-78) in its local web UI component. The component is disabled by default and VMware advises against enabling it on untrusted networks, but when reachable it allows remote code execution. It matters because the flaw is confirmed exploited in the wild and carries a very high EPSS probability.

Impact

A successful attacker executes arbitrary commands on the edge device, gaining code execution with the privileges of the web UI service. That can lead to full compromise of the appliance and any trust it holds in the SD-WAN fabric.

Attack surface

Reachable over the network via the local web UI (CVSS vector AV:N, PR:N, UI:N), so no authentication or user interaction is required. The service is disabled by default, so exposure depends on an administrator having enabled it, and it should not be exposed to untrusted networks.

Exploitation

CISA added it to the Known Exploited Vulnerabilities catalog on 2022-03-25 with a 2022-04-15 remediation due date, and a public Exploit-DB entry (44959) exists. EPSS gives a 30-day probability of 0.86252 (99.7th percentile), indicating high likelihood of exploitation activity.

What to do

  • Upgrade NSX SD-WAN Edge by VeloCloud to version 3.1.0 or later per the vendor advisory VMSA-2018-0011.
  • Keep the local web UI component disabled unless operationally required, and never expose it to untrusted networks.
  • Restrict management access to the web UI with firewall rules and network segmentation to trusted admin networks only.
  • Monitor for the service being re-enabled and treat any exposure as urgent given active exploitation.
  • Plan for the vendor's removal of this service in future releases and migrate off it.

Detection

  • Audit edge devices for the local web UI service being enabled and reachable from untrusted networks.
  • Inspect web server and system logs for command injection patterns or unexpected shell metacharacters in web UI requests.
  • Monitor for unexpected child processes or shell execution spawned by the web UI service on edge appliances.
  • Alert on outbound connections from edge devices to unknown hosts that could indicate post-exploitation activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.

Exploitation in the wild

CISA added CVE-2018-6961 to the Known Exploited Vulnerabilities catalog on 25 March 2022 as "VMware SD-WAN Edge by VeloCloud Command Injection Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 15 April 2022.

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.securityfocus.com/bid/104185 Broken LinkThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1041210 Broken LinkThird Party AdvisoryVDB Entry
http://www.vmware.com/security/advisories/VMSA-2018-0011.html Vendor Advisory
https://www.exploit-db.com/exploits/44959/ ExploitThird Party AdvisoryVDB Entry
http://www.securityfocus.com/bid/104185 Broken LinkThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1041210 Broken LinkThird Party AdvisoryVDB Entry
http://www.vmware.com/security/advisories/VMSA-2018-0011.html Vendor Advisory
https://www.exploit-db.com/exploits/44959/ ExploitThird Party AdvisoryVDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-6961 US Government Resource

Track CVE-2018-6961 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2026-53266Linux kernel ebtables SNAT out-of-bounds write in ARP rewriteThe ebtables SNAT target rewrites the ARP sender hardware address via skb_store_bits() without first making that range writable. When the ARP SHA byt…KEVEPSS 0.65%analysed8.8CVE-2026-87491Google Chrome V8 out-of-bounds write enables sandbox code executionChrome before 153.0.8010.36 contains an out-of-bounds write in the V8 JavaScript engine. A crafted HTML page can trigger the memory corruption, and b…KEVEPSS 3.1%analysed9.8CVE-2025-25249Fortinet FortiOS and FortiSwitchManager heap buffer overflow via crafted packetsA heap-based buffer overflow (CWE-122/CWE-787) in Fortinet FortiOS 6.4 through 7.6.3 and FortiSwitchManager 7.0 through 7.2.6 lets an unauthenticated…KEVEPSS 3.9%analysed7.8CVE-2026-83549SonicWall SMA1000 AMC OS Command InjectionThe SMA1000 Appliance Management Console contains an OS command injection flaw (CWE-78) that lets an authenticated administrator execute arbitrary op…KEVEPSS 11%analysed10.0CVE-2026-49869Kestra OSS auth bypass via path suffix match enables RCEKestra OSS AuthenticationFilter whitelists the public config endpoint using request.getPath().endsWith("/configs"), a suffix match instead of an exac…KEVEPSS 2.1%analysed7.8CVE-2026-53362Linux kernel IPv6 UDP paged allocation out-of-bounds write__ip6_append_data() in the Linux kernel mis-accounts fraggap on the paged-allocation path, leaving the linear skb area undersized while pagedlen is o…KEVEPSS 0.71%analysed7.8CVE-2022-0995Linux kernel watch_queue out-of-bounds writeThe Linux kernel's watch_queue event notification subsystem contains an out-of-bounds write (CWE-787) that can overwrite kernel state. A local user c…KEVEPSS 8.8%analysed8.9CVE-2026-73570Zimbra Collaboration SNMP notification OS command injectionZimbra Collaboration Suite before 10.1.20 contains an OS command injection flaw in SNMP notification processing when the optional zimbra-snmp package…KEVEPSS 12%analysed

Source: NIST National Vulnerability Database (record CVE-2018-6961), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.