CVE-2026-15495
SonicCloudOrg sonic-agent Android WebSocket Server AndroidWSServer.java os command injection
CVSS Score
6.3
EPSS Score
1.5%
EPSS Percentile
72th
A vulnerability has been found in SonicCloudOrg sonic-agent up to 2.7.2. The affected element is an unknown function of the file AndroidWSServer.java of the component Android WebSocket Server. The manipulation of the argument path leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
| CWE | CWE-78 CWE-77 |
| Vendor | soniccloudorg |
| Product | sonic-agent |
| Published | Jul 12, 2026 |
| Last Updated | Jul 15, 2026 |
Stay Ahead of the Next One
Get instant alerts for soniccloudorg sonic-agent
Be the first to know when new medium vulnerabilities affecting soniccloudorg sonic-agent are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
SonicCloudOrg / sonic-agent
2.7.0 2.7.1 2.7.2
References
vuldb.com: https://vuldb.com/vuln/377802 vuldb.com: https://vuldb.com/vuln/377802/cti vuldb.com: https://vuldb.com/cve/CVE-2026-15495 vuldb.com: https://vuldb.com/submit/844484 github.com: https://github.com/xpp3901/CVE_APPLY/tree/main/V-S003_SonicAgent_pullFile_CmdInjection_RCE github.com: https://github.com/xpp3901/CVE_APPLY/blob/main/V-S003_SonicAgent_pullFile_CmdInjection_RCE/poc_pullfile_rce.py
Credits
🔍 xpp39 (VulDB User) VulDB CNA Team