Hermes WebUI — CVE-2026-58123 (Critical)

Date Jul 9, 2026

Type Vendor advisory

Signal Critical vendor advisory

Vendor / Product Hermes · WebUI

CVE CVE-2026-58123

Critical vendor advisory CVE-2026-58123

Summary

Hermes WebUI before 0.51.788 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary shell commands by accessing the embedded terminal API endpoints without credentials. Attackers can create a session, attach a PTY shell, and write arbitrary commands through the terminal input endpoint to achieve full command execution as the server process user via four sequential unauthenticated HTTP requests.

Why it matters

This CVE carries a CRITICAL severity rating (CVSS 9.8) in Hermes WebUI. Patch or mitigate promptly.

Operator check

Review CVE-2026-58123 in your asset inventory. Apply patches per vendor guidance and verify WebUI is not exposed. CVSS score: 9.8.

Sources

NVD — CVE-2026-58123 Source reference Source reference

PatchBrief uses public sources. It does not scan environments, verify exposure, or replace vendor guidance.

Get watched-vendor alerts Subscribe free Back to feed