C-Kermit 6.0.192 before 11.1.515 Command Execution via REMOTE QUERY
Not on CISA's list of exploited flaws, and not in the news we track.
0.68%
Fix it in your code
Each opens with a short prompt that points at Global Hack Map's public runbook for CVE-2026-129125. Nothing runs until you send it.
C-Kermit 6.0.192 before 11.1.515 contains a remote code execution vulnerability that allows Kermit clients to run shell commands on servers with host commands disabled by abusing REMOTE QUERY evaluation. Attackers can send a REMOTE QUERY invoking the command function, or define a macro via REMOTE ASSIGN and call execute to reach RUN, bypassing the nopush restriction and DISABLE HOST.