Command Injection Vulnerability in SoftIron HyperCloud Orchestrator

CVE-2026-116755

What is CVE-2026-116755?

The Orchestrator component of SoftIron HyperCloud is susceptible to a command injection vulnerability that permits authenticated users with access to the management plane to execute arbitrary operating system commands on hypervisor hosts. This security flaw arises when attacker-controlled content from virtual machine templates, specifically within the VM DESCRIPTION field, is received through a poorly secured shell here-document. The issue leads to unquoted terminators that allow shell expansion and here-document terminator injection during critical virtual machine operations such as deployment, migration, and network setup. To exploit this vulnerability, attackers must possess valid credentials and conduct operations that impact the affected host.

References