External risk intelligence

Command Injection in NPC Start Endpoint

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-22103

The vulnerability resides in a web server endpoint accessible via a network port (8090). Web-based management interfaces or service endpoints on non-standard ports are commonly exposed in internet-facing configurations or internal service deployments, making them plausible targets for remote network access.

Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This CVE identifies a command injection vulnerability in a web server's NPC start endpoint, accessible via port 8090. The concern is that unauthenticated network access to this endpoint could allow an attacker to execute arbitrary commands on the affected system. The main concern is confirming relevance and exposure.

Attackers can inject commands through a web service.
Leadership should remember potential for unauthorized system control.
Confirm if our systems use this web service endpoint.

Attack Path

How an attacker could exploit the issue

An attacker could reach the vulnerable NPC start endpoint on the web server by sending network requests to port 8090. This endpoint is exposed externally and does not require any authentication or user interaction to be accessed. If an attacker successfully sends specially crafted input to this endpoint, it could lead to the execution of arbitrary commands on the server.

Network access to port 8090.
Sending unauthenticated network requests.
Arbitrary command execution on the server.

Live Threat

Current exploitation, exposure, and threat context

The NPC start endpoint on the web server at port 8090 could be exploited to inject commands, potentially affecting service behavior.

Service behavior at risk.
Through network access to the endpoint.
Unauthorized command execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

The NPC start endpoint on a web server is vulnerable to command injection, indicating a potential risk for environments exposing this service. The first practical step is to identify all instances of this web server, determine their network exposure and business criticality, and then ascertain the accountable team or owner for remediation planning.

Application or infrastructure owners should lead.
Verify external and internal exposure.
Plan remediation based on business risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the NPC component affected by CVE-2026-22103?

The NPC component functions as a web server listener that manages specific service operations through an endpoint running on port 8090. It is typically used to handle start-up commands or configuration requests for the underlying service. Because it acts as an interface between network requests and system-level operations, it occupies a sensitive position in the application stack.

How does this vulnerability allow command injection?

This flaw is classified as CWE-77, or Improper Neutralization of Special Elements used in a Command. In simple terms, the application fails to scrub or validate data provided by a user before passing it to the operating system. Consequently, an attacker can append their own malicious commands to a legitimate request, tricking the server into running unintended and potentially harmful instructions with system-level permissions.

Do I need to be logged in to trigger this command injection?

No. The vulnerability exists in a way that does not require any form of authentication or user interaction. An attacker simply needs network access to the target server on port 8090 to send the crafted request. If your network configuration blocks unauthorized traffic from reaching that port, the specific path to trigger this command execution is closed.

Why is Halo Surface Signal labeling this as likely relevant?

Halo Surface Signal identifies this as relevant because the vulnerable endpoint resides on a non-standard network port (8090) that is often left open in various deployment environments. Since the vulnerability is remotely accessible without credentials, any system running this web server that is reachable over a network—whether internal or external—is considered a potential target for unauthorized command execution.

What steps should I take if I am running this technology?

Start by identifying all servers in your environment that are listening on port 8090. Once you have a list of these instances, evaluate whether they are exposed to untrusted networks or if they reside within a restricted segment. Engage the teams responsible for these applications to confirm if the NPC endpoint is in use and prioritize them for remediation according to your internal security policies.

References

csirt.divd.nl/DIVD-2026-00001/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.