CVE-2026-12104: Authenticated OS Command Injection in Bondix Server

Vulnerability Overview Vulnerability Name: CVE-2026-12104 — Authenticated OS Command Injection in Bondix Status: Reserved / Pending publication Severity: High Affected Product: Bondix Server Affected Platform: Linux Affected Versions: Up to and including 1.25.7.5 Fixed Version: 1.25.7.6 CVE Number: CVE-78 — OS Command Injection CVSS Score: 8.6 High Description An authenticated operating system command injection vulnerability has been identified in Bondix Server for Linux. An attacker with configuration write privileges can execute arbitrary OS commands by submitting configuration values processed by server-side scripts. Remediation Recommended Action: Upgrade to Bondix Server version 1.25.7.6 or later. CVSS Vector General Security Recommendations Keep Bondix installations updated to the latest version. Restrict management and configuration write privileges to trusted users. Regularly review security-related changelogs. If you suspect your system is affected, contact SIMA GmbH support. Reporting Security Issues If you believe you have discovered a security vulnerability in Bondix, please contact SIMA GmbH through official support channels. Provide a clear description of the issue, the affected version, reproduction steps (if available), and any relevant logs or configuration details. Revision History 2026-06-18: Initial security advisory page.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-12104: Authenticated OS Command Injection in Bondix Server