High severity · published May 25, 2026
CVE-2026-8652
An OS Command Injection vulnerability exists in Aterm
8.5
CVSS
0.7%
EPSS
No
On KEV
Description
An OS Command Injection vulnerability exists in Aterm. If a malicious third person gains administrator access to the product’s web console, they may be able to execute arbitrary OS commands via adjacent network.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
Aterm CM51FD · NEC Platforms, Ltd.
Before Ver. 1.2.0 · source: vendor
AM
Aterm MR51FN · NEC Platforms, Ltd.
Before Ver. 3.4.0 · source: vendor