CVE-2026-47786
CriticalCVSS 9.3Exploitation Probability (EPSS)
Elevated risk72th percentile - higher than 72% of all known CVEs
Summary
An OS command injection vulnerability has been reported in HybridDesk Station, which could allow remote attackers to execute arbitrary commands. The vulnerability has been fixed in versions 4.2.23 and 4.3.4 and later.
Risk Assessment
The vulnerability could lead to full system takeover by a remote attacker. Organizations using HybridDesk Station are exposed to arbitrary code execution.
Recommendation
Update HybridDesk Station to version 4.2.23, 4.3.4, or later. Check for any unauthorized command execution.
Other vulnerabilities in HybridDesk Station
See all- CVE-2026-39997High
A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to gain access to the system.
- CVE-2025-44015High
A command injection vulnerability has been reported in HybridDesk Station. An attacker with local network access can exploit it to execute arbitrary commands.
Original NVD description (English source)
An OS command injection vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following version: HybridDesk Station 4.2.23 and later HybridDesk Station 4.3.4 and later
Vulnerability data from NVD (NIST) · CISA KEV · EPSS