CVE-2026-103038

High

Description

PingTools Network Utilities 4.64 contains an OS command injection vulnerability in the Host field of a Watcher ICMP service. The application appends the attacker-controlled Host value to a ping command, serializes the command as a single string, and executes it through sh -c. A local attacker who can create or modify a Watcher service can inject shell syntax and execute arbitrary commands with the PingTools application UID and its granted Android permissions.

SeverityHigh

CVSS8.6

Exploit probability—

ProductStreamsoft Pingtools Network Utilities

PublishedOct 19, 2026

First seenOct 19, 2026

Weakness typeCWE-78OS command injection

How to fix

Vendor advisories

fluidattacks.com/advisories/yanderechainsawregurgitationfactory

Affected products

Product	Affected versions	Fixed in
streamsoft pingtools_network_utilities	4.64	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.