RCE in Lms

CVE-2026-40456

An OS Command Injection vulnerability exists in LMS (LAN Management System) before commit 9fcb4de due to an IP address parameter being passed to the "exec()" function without proper validation, allowing attackers to execute arbitrary operating system commands.

Vulnerability class: Command Injection (OS Command Injection)

Published · last modified .

EPSS exploit prediction

EPSS: 0.028 (85.9th percentile), scored .

Low probability of exploitation in the next 30 days, but still tracked. 86th percentile — 85.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2026-40456: rose from 0.009 to 0.028.

EPSS over last 30 days · oldest: 0.009 · newest: 0.028 · change: +0.018

Affected products

  • Lms — versions 0

Weakness classification (CWE)

References