CVE-2026-35682

CVE-2026-35682 is an authenticated command injection vulnerability in Anviz CX2 Lite that allows attackers to execute arbitrary commands through a malicious filename parameter, potentially gaining root-level access to affected systems. The vulnerability carries a CVSS score of 8.8 (High severity) with a network-based attack vector requiring low complexity and valid user credentials; it enables complete compromise of system confidentiality, integrity, and availability. Currently, there is no evidence of active exploitation in the wild, as the vulnerability does not appear on the KEV catalog or active threat lists, though the EPSS score of 0.0027 indicates a relatively low probability of exploitation compared to the broader CVE population.