CVE-2026-28517: exploitation status and patch state

CVE-2026-28517 · CVSS 9.8 CRITICAL · EPSS 6%

openDCIM version 23.04, through commit 4467e9c4, contains an OS command injection vulnerability in report_network_map.php. The application retrieves the 'dot' configuration parameter from the database and passes it directly to exec() without validation or sanitation. If an attacker can modify the fac_Config.dot value, arbitrary commands may be executed in the context of the web server process.

Is CVE-2026-28517 exploited?

• Not in the CISA KEV catalog.
• EPSS puts exploitation in the next 30 days at 6%.
• Public exploit code: packaged in a public tool.

Which products and versions are affected?

No affected package list recorded here yet.

Is there a patch?

No patch identifier recorded here yet.

What PlainSec published about CVE-2026-28517

• Metasploit Adds Public RCE Modules for Web Apps (2026-04-18)

Primary sources

• NVD record
• Metasploit: exploit/linux/http/opendcim_install_sqli_rce

What this record does not say

• No affected package data.
• No patch identifier.

KEV and EPSS are re-checked daily. Record last updated 2026-08-14.