s2
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

CVE-2026-7785

📛 CVE Title

A-G-U-P-T-A wireshark-mcp pyshark_mcp.py quick_capture os command injection

⬇ Download JSON ⚠ View as Threat

Description

A security flaw has been discovered in A-G-U-P-T-A wireshark-mcp edaf604416fbc94a201b4043092d4a1b09a12275/400c3da70074f22f3cce7ccb65304cafc7089c89. This affects the function quick_capture of the file pyshark_mcp.py. The manipulation results in os command injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.

Overview

State
PUBLISHED
Assigner (CNA)
VulDB
CVSS severity
MEDIUM
CVSS score
CVSS 6.9 / 10 6.9 6.9 / 10
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Effective score
6.9 / 10 MEDIUM source: CNA overview
CWE(s)
CWE-78, CWE-77
Reserved
2026-05-04
Published
2026-05-05 01:45 UTC
Last updated
2026-05-05 14:38 UTC
Source
https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7785.json
Linked Threat
CVE-2026-7785 — CVE-2026-7785

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published
2026-05-05 00:16:17 UTC
NVD last modified
2026-05-05 19:10:02 UTC
NVD CVSS v3.1
CVSS 7.3 / 10 7.3 7.3 / 10 HIGH source: cna@vuldb.com
NVD CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Exploitability subscore
3.9 / 10
Impact subscore
3.4 / 10
EPSS score
0.0218 (probability of exploitation in next 30 days)
EPSS percentile
84.55% vs all CVEs — higher = more likely to be exploited, as of 2026-05-24

NVD / KEV / EPSS data refreshed 2026-05-25 06:33 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID
EUVD-2026-27159
Assigner
VulDB
Published
May 4, 2026, 11:45:16 PM
Updated
May 5, 2026, 12:38:54 PM
EUVD base score (CVSS 4.0)
6.9 / 10
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EUVD-reported EPSS
2.1800
Vendors
A-G-U-P-T-A
Products
wireshark-mcp (edaf604416fbc94a201b4043092d4a1b09a12275)
wireshark-mcp (400c3da70074f22f3cce7ccb65304cafc7089c89)

ENISA description: A security flaw has been discovered in A-G-U-P-T-A wireshark-mcp edaf604416fbc94a201b4043092d4a1b09a12275/400c3da70074f22f3cce7ccb65304cafc7089c89. This affects the function quick_capture of the file pyshark_mcp.py. The manipulation results in os command injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.

EUVD references (5)

Affected products (1)
VendorProductVersionsPlatforms
A-G-U-P-T-A wireshark-mcp 400c3da70074f22f3cce7ccb65304cafc7089c89 (affected), edaf604416fbc94a201b4043092d4a1b09a12275 (affected) —

Vendor references (5)

References embedded in the original CVE record by the assigning CNA.

MITRE references (5) cveawg.mitre.org

Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.

Web references (3)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

NVD-tagged references (5)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

Remediations (19)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

  • Microsoft Releases Mitigation for Windows BitLocker Security Bypass 0 ...
    web:cybersecuritynews.com

    No patch has been released yet; Microsoft has instead issued a multi-step manual mitigation guide while a formal security update is prepared. Windows BitLocker Security Bypass The vulnerability originates in WinRE's handling of the BootExecute registry value under HKLM\ControlSet001\Control\Session Manager.

    2026-05-23 21:15 UTC
  • Security Update Guide - Microsoft
    web:msrc.microsoft.com

    The Microsoft Security Response Center (MSRC) investigates all reports of security vulnerabilities affecting Microsoft products and services, and provides the information here as part of the ongoing effort to help you manage security risks and help keep your systems protected.

    2026-05-23 21:15 UTC
  • Security Update Guide - Microsoft
    web:portal.msrc.microsoft.com

    The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.

    2026-05-23 21:15 UTC
  • Microsoft Rushes to Mitigate Dangerous New "YellowKey" Windows Exploit
    web:windowsreport.com

    The newly exposed Windows security flaw, dubbed "YellowKey," has become a major headache for Microsoft. After the exploit details leaked publicly alongside a working proof-of-concept, the company has now rushed out official mitigation guidance while it prepares a permanent fix . The vulnerability reportedly targets BitLocker-protected systems and could allow attackers direct access to ...

    2026-05-23 21:15 UTC
  • Microsoft Patch Tuesday August 2025 - Critical Fixes | Absolute ...
    web:www.absolute.com

    Microsoft Patch Tuesday August 2025 delivers 109 fixes, including critical vulnerabilities in MSMQ, NTLM, and graphics components. Stay protected.

    2026-05-23 21:15 UTC
  • Microsoft provides mitigation for "YellowKey" BitLocker bypass flaw ...
    web:www.helpnetsecurity.com

    Microsoft is working on a fix for CVE - 2026 -45585 (aka "Yellowkey"), a vulnerability that can be used to bypass Windows' BitLocker protection.

    2026-05-23 21:15 UTC
  • Microsoft Rushes Out Emergency Mitigation For 'YellowKey ... - LinkedIn
    web:www.linkedin.com

    Microsoft Security Response Center has issued an emergency mitigation for a newly disclosed BitLocker bypass vulnerability known as "YellowKey," after security researchers publicly released ...

    2026-05-23 21:15 UTC
  • Microsoft mitigates YellowKey BitLocker bypass, no patch yet
    web:www.notebookcheck.net

    Microsoft released mitigation steps for YellowKey ( CVE - 2026 -45585), a BitLocker bypass that grants physical attackers access to encrypted Windows drives.

    2026-05-23 21:15 UTC
  • Microsoft Rolls Out Mitigations for 'YellowKey' BitLocker ...
    web:www.securityweek.com

    Microsoft has announced mitigations for CVE - 2026 -45585, a BitLocker bypass triggered via FsTx in Windows Recovery.

    2026-05-23 21:15 UTC
  • Patch Tuesday May 2026: Security Updates & CVE Analysis
    web:zecurit.com

    Get the complete breakdown of Microsoft's May 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .

    2026-05-23 21:15 UTC
  • Micropatches - 0patch
    web:0patch.com

    Fixing what's really important. The goal of 0patch is not to micropatch every vulnerability but the important ones, such as those exploited in the wild or those without official vendor patches. These are some of our most popular micropatches.

    2026-06-03 07:49 UTC
  • Zero Day (i.e., Critical) Security Patches for vSphere 8.x Perpetual ...
    web:knowledge.broadcom.com

    The intent of this article is to help customers that are using VMware vSphere 8.x address the most critical security vulnerabilities. Broadcom will provide all perpetual license customers, including those that have expired support contracts, with access to zero-day security patches, which are defined by Broadcom as patches for Critical Severity Security Alerts with a Common Vulnerability ...

    2026-06-03 07:49 UTC
  • NVD - Home
    web:nvd.nist.gov

    The NVD is the U.S. government repository of standards based vulnerability management data represented using the Security Content Automation Protocol (SCAP). This data enables automation of vulnerability management, security measurement, and compliance. The NVD includes databases of security checklist references, security-related software flaws, product names, and impact metrics. For ...

    2026-06-03 07:49 UTC
  • Landing Page | ServiceNow Common Vulnerabilities & Exposures (CVE ...
    web:support.servicenow.com

    Overview The advisories below document publicly disclosed Common Vulnerabilities and Exposures ( CVEs ) in the Now Platform by ServiceNow. Because ServiceNow uses various methods to communicate vulnerability information, patches, and other fixes, customers should review family, security patch , and hotfix release notes, which are available at https://docs.servicenow.com, for a complete list of ...

    2026-06-03 07:49 UTC
  • VMware ESXi 8.0 Update 3d Release Notes
    web:techdocs.broadcom.com

    Patch Category Security Patch Severity Critical Host Reboot Required Yes Virtual Machine Migration or Shutdown Required Yes Affected Hardware N/A Affected Software N/A Affected VIBs Included VMware_bootbank_esxio-update_8..3-.60.24585383 VMware_bootbank_loadesxio_8..3-.60.24585383 PRs Fixed N/A CVE numbers N/A Due to their dependency on the ...

    2026-06-03 07:49 UTC
  • ArcGIS Server Security 2025 Update 2 Patch - Esri
    web:www.esri.com

    Key highlights The ArcGIS Server Security 2025 update 2 is available This patch resolves 10 Medium severity vulnerabilities This security patch is cumulative, and includes fixes provided in the ArcGIS Server Security 2025 update 1.

    2026-06-03 07:49 UTC
  • Security Update Guide FAQs - microsoft.com
    web:www.microsoft.com

    These Knowledge Base articles accompany all security updates and advisories, and include caveats or known issues with security updates. Additionally, support engineers document common concerns from customers in these KB articles. These Knowledge Base articles are published the Security Update Guide with each release on Patch Tuesday.

    2026-06-03 07:49 UTC
  • Oracle Critical Patch Update Advisory - April 2025
    web:www.oracle.com

    A Critical Patch Update is a collection of patches for multiple security vulnerabilities. These patches address vulnerabilities in Oracle code and in third party components included in Oracle products. These patches are usually cumulative, but each advisory describes only the security patches added since the previous Critical Patch Update Advisory.

    2026-06-03 07:49 UTC
  • Oracle Critical Patch Update Advisory - October 2025
    web:www.oracle.com

    This Critical Patch Update contains 374 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at October 2025 Critical Patch Update: Executive Summary and Analysis.

    2026-06-03 07:49 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-7785.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-7785",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-05T12:38:48.524391Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-05T12:38:54.717Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "wireshark-mcp",
          "vendor": "A-G-U-P-T-A",
          "versions": [
            {
              "status": "affected",
              "version": "400c3da70074f22f3cce7ccb65304cafc7089c89"
            },
            {
              "status": "affected",
              "version": "edaf604416fbc94a201b4043092d4a1b09a12275"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "CPT_Penner (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A security flaw has been discovered in A-G-U-P-T-A wireshark-mcp edaf604416fbc94a201b4043092d4a1b09a12275/400c3da70074f22f3cce7ccb65304cafc7089c89. This affects the function quick_capture of the file pyshark_mcp.py. The manipulation results in os command injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 7.5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "OS Command Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-77",
              "description": "Command Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-04T23:45:16.986Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-360985 | A-G-U-P-T-A wireshark-mcp pyshark_mcp.py quick_capture os command injection",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/360985"
        },
        {
          "name": "VDB-360985 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/360985/cti"
        },
        {
          "name": "Submit #807745 | A-G-U-P-T-A wireshark-mcp 400c3da70074f22f3cce7ccb65304cafc7089c89 Command Injection",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/807745"
        },
        {
          "tags": [
            "exploit",
            "issue-tracking"
          ],
          "url": "https://github.com/A-G-U-P-T-A/wireshark-mcp/issues/1"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/A-G-U-P-T-A/wireshark-mcp/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-05-04T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-05-04T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-05-04T18:09:41.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "A-G-U-P-T-A wireshark-mcp pyshark_mcp.py quick_capture os command injection"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-7785",
    "datePublished": "2026-05-04T23:45:16.986Z",
    "dateReserved": "2026-05-04T16:04:35.270Z",
    "dateUpdated": "2026-05-05T12:38:54.717Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}