CVE-2026-18901
H3C NX15 Web API esps service.add routine
CVSS Score
7.2
EPSS Score
0.0%
EPSS Percentile
0th
A security vulnerability has been detected in H3C NX15 V100R017. Affected is the function service.add of the file /api/esps of the component Web API. Such manipulation leads to exposed dangerous routine. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.
| CWE | CWE-749 |
| Vendor | h3c |
| Product | nx15 |
| Published | Aug 5, 2026 |
Stay Ahead of the Next One
Get instant alerts for h3c nx15
Be the first to know when new high vulnerabilities affecting h3c nx15 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
H3C / NX15
V100R017
References
vuldb.com: https://vuldb.com/vuln/385935 vuldb.com: https://vuldb.com/vuln/385935/cti vuldb.com: https://vuldb.com/cve/CVE-2026-18901 vuldb.com: https://vuldb.com/submit/857817 github.com: https://github.com/coconut652-7/IOT_Vul_Public/tree/main/H3C/NX15R017/service_add_root_rce_chain/report github.com: https://github.com/coconut652-7/IOT_Vul_Public/blob/main/H3C/NX15R017/service_add_root_rce_chain/poc/postauth_service_add_rce.py
Credits
🔍 coconut (VulDB User) VulDB CNA Team