CVE-2026-9157 Remote Code Execution in Gmission Web FAX
Attackers can upload malicious files to Gmission Web Fax to achieve remote code execution due to improper input validation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-9157?
CVE-2026-9157 is a high-severity vulnerability in Gmission Web Fax, published on 21 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Improper input validation, Unrestricted upload of file with dangerous type vulnerability in Gmission Web Fax allows Remote Code Inclusion.
This issue affects Web Fax: from 3.0 before 3.1.
Which versions are affected by CVE-2026-9157?
How do I fix CVE-2026-9157?
No fix has been published for CVE-2026-9157 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-9157 being exploited?
There is no known exploitation of CVE-2026-9157 in the wild and no public exploit code.
Sources
Also known as GHSA-w95q-h4rm-mxfm.