CVE-2023-36255: Eramba path parameter code injection allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityCVSS 8.8 with high EPSS and a public exploit reference make this a serious remote code execution risk, though it requires low privileges and no KEV listing is present.

What it is

Eramba Enterprise and Community edition v3.19.1 is affected by a code injection flaw (CWE-94) reachable through the path parameter in the URL. A remote attacker with low privileges can execute arbitrary code on the server, which matters because it can lead to full compromise of the application host.

Impact

An attacker gains arbitrary code execution on the Eramba server, with high impact to confidentiality, integrity and availability. This can result in data theft, tampering, or full host takeover.

Attack surface

The flaw is reached over the network via the path parameter in the URL, requiring low privileges (authenticated user) and no user interaction. No other preconditions are described in the record.

Exploitation

No CISA KEV listing and no ransomware association are recorded; EPSS is high at 0.53062 (98.9th percentile), and a third-party advisory is tagged as Exploit, indicating public exploit information exists.

What to do

• Upgrade Eramba Enterprise and Community edition to a version later than 3.19.1; the record does not list fixed versions, so confirm with the vendor.
• Restrict network access to the Eramba web interface to trusted users and networks.
• Review and minimize accounts with low-privilege access that could reach the vulnerable path parameter.
• Monitor vendor advisories and the referenced Trovent advisory for updated guidance.

Detection

• Inspect web server and application logs for requests with suspicious or malformed path parameters targeting Eramba endpoints.
• Alert on unexpected child processes or command execution spawned by the Eramba web service.
• Monitor for outbound connections or file writes from the Eramba server that deviate from normal behavior.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.