High 8.8Published Oct 19, 2026

CVE-2026-77926Aix-DB 1.2.4 Authenticated RCE via ChatBI Common Agent Execute Tool

Updated under an hour ago (Oct 26, 2026, 5:40 PM ET)

Does this affect you?

It affects apconw Aix-DB. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 0.85%, higher than 58% of scored CVEs.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for apconw Aix-DB

Exploited in the last 30 days

Aix-DB 1.2.4 contains a remote code execution vulnerability that allows authenticated non-admin users to run operating system commands through the ChatBI common agent's ungated deepagents execute tool. Attackers can send crafted chat input to POST /dify/get_answer or upload documents with malicious text to run host commands, exposing datasource credentials and model API keys.

CVSS: 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-749
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 0.85% (percentile 58)
Assigned by: VulnCheck
NVD analysis: Deferred
Record last updated: Oct 20, 2026
First seen by InfoSec Signals: Oct 19, 2026

Affected products

Affected products

apconw Aix-DB apconw:aix_db (from the name)	from 1.2.4 through 1.2.4	CNA record

References

References

https://www.lasso.security/vulnerability-database/cve-2026-77926	technical-description, exploit
https://github.com/apconw/Aix-DB/blob/5d370adf3e695fc8b11137e5beeb01973cb46810/agent/common/enhanced_common_agent.py#L237	technical-description
https://www.vulncheck.com/advisories/aix-db-1.2.4-authenticated-rce-via-chatbi-common-agent-execute-tool	third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.