CVE-2026-107510 Details
Description
An authenticated high privilege user can inject arguments in troubleshooting commands resulting in privilege escalation.
A vulnerability exists in Infoblox NIOS that allows an authenticated high-privilege user to inject arguments into troubleshooting commands. This injection can be exploited to escalate privileges, potentially leading to unauthorized root access on the appliance. The issue arises from improper access control and privilege management, allowing exploitation by users with access to the Maintenance Mode CLI.
Infoblox has released hotfixes for all supported NIOS versions. Customers should apply the hotfix corresponding to their NIOS release. A permanent fix is included in NIOS 9.2.0.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 8, 2026CISA-ADP
Assessed Oct 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://aumlayer.com/insights/administrator-is-not-root-infoblox-nios-privilege-escalation/ | f84ca5ce-fbe7-4668-8724-994599108a02 | |
| https://support.infoblox.com/s/article/Security-Advisory-NIOS-Maintenance-Mode-Permits-Root-Shell | f84ca5ce-fbe7-4668-8724-994599108a02 | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-269 | Improper Privilege Management | CISA-ADP |
| CWE-284 | Improper Access Control | CISA-ADP |
| CWE-88 | Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Infoblox NIOS | < 9.2.0 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 9, 2026 | CVE Modified | f84ca5ce-fbe7-4668-8724-994599108a02 |
| Oct 8, 2026 | CVE Modified | CISA-ADP |
| Oct 8, 2026 | New CVE Received | f84ca5ce-fbe7-4668-8724-994599108a02 |