CVE-2026-12195

High

Description

myVesta is affected by an authenticated remote code execution vulnerability. Low privileged users can insert arbitrary commands as a part of the v_ftp_user parameter when deleting FTP usernames. This could result in the execution of commands as the admin user or takevoer of the admin user in myVesta.

SeverityHigh

CVSS8.5

Exploit probability—

ProductVesta

PublishedJul 4, 2026

First seenJul 4, 2026

Weakness typeCWE-78OS command injection

How to fix

Update

myvesta vesta95d7e43bf286d6881ca753dac93cb42d98cc7422 or later

Patches

github.com/myvesta/vesta/commit/95d7e43bf286d6881ca753dac93cb42d98cc7422

Affected products

Product	Affected versions	Fixed in
myvesta vesta	v < 95d7e43bf286d6881ca753dac93cb42d98cc7422	95d7e43bf286d6881ca753dac93cb42d98cc7422

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.