CVE-2026-26068 is a critical command injection flaw (CVSS 9.9) in emp3r0r, a Linux command and control framework. Untrusted agent metadata is placed into tmux shell commands on the operator host. If you run it, upgrade to 3.21.1. The record does not list it in CISA's KEV catalog, and the sources we read do not report exploitation.
What's affected
- emp3r0r 3.21.0, per the advisory, and versions before 3.21.1 per the record
- Fixed in 3.21.1
The advisory lists no workaround. This matters to red teams and researchers who operate the tool. It is a tool for adversary simulation, and the flaw affects the operator side.
How to check if you're exposed
Check the release you run against v3.21.1. If you operate the framework on a shared or internet-reachable host, also consider which untrusted systems have been able to check in, since the flawed values arrive at check-in.
If you do not use the framework, there is nothing to check.
What to do now
- Upgrade emp3r0r to 3.21.1 or later.
- Run operator infrastructure in an isolated environment that you can rebuild.
- Treat all agent supplied fields as untrusted text, including host names.
- Rotate credentials on any operator host that handled check-ins from systems you do not control.
- Review your own tooling for code that builds shell strings from remote values.
Why it matters
CWE-77 and CWE-78 describe command injection and OS command injection. The advisory says the Transport and Hostname fields arrive at check-in, are interpolated into tmux command strings, and then run through /bin/sh. Because a shell reads those strings, special characters in a value can become commands.
The interesting twist is the direction. Usually the operator is the target and the tool the weapon. Here, data sent by a remote agent can reach back to the operator. Security tools handle hostile input by design, so they need the same input handling discipline as any internet facing service.
The record scores the flaw 9.9 because a low privileged remote party can affect a different security scope, the operator host.
Quick check
Who is affected?
People who run emp3r0r as operators. The code path is on the operator host.
What is the general lesson?
Do not build shell command strings from remote values. Pass arguments as separate parameters, or avoid the shell.
Sources
Last reviewed: 19 October 2026.
