External risk intelligence

Dnsmgr Ping Function Arbitrary Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-35847

The vulnerability is explicitly described as requiring a local attacker to execute arbitrary code. Local-only access requirements mean the attack surface is not exposed to the public internet in common deployments.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects a DNS management tool, specifically its ping function. The identified weakness could potentially allow an attacker to run their own code on affected systems. The primary concern at this time is to confirm if this specific technology is in use within our environment.

A code execution flaw exists in a DNS tool.
Local attackers could potentially exploit this.
Confirm relevance and exposure within our systems.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by accessing a system where the vulnerable software is installed. They could then use the `ping` function within the `CheckUtils.php` file to execute arbitrary code. This could potentially lead to a complete compromise of the system.

Requires local access.
Exploits the `ping` function.
Leads to arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

A critical vulnerability exists in dnsmgr versions prior to 2.15, specifically within the ping function of CheckUils.php, which could allow a local attacker to execute arbitrary code. This exposure may affect system data and service behavior when a local user can trigger the vulnerable function.

System data and service behavior.
Triggered by a local user.
Arbitrary code execution possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

Addressing this critical vulnerability will likely require collaboration between application owners, who manage the `CheckUtils.php` file, and infrastructure or platform teams responsible for the environment where `dnsmgr` is deployed. The first practical step is to identify all instances of `dnsmgr` within your organization, assess their network exposure, and determine their business criticality. Once these are understood, you can accurately assign ownership and plan a risk-based remediation strategy.

Identify the accountable application owner.
Verify `dnsmgr` reachability and criticality.
Plan phased remediation by risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is dnsmgr?

dnsmgr is a software utility designed for managing Domain Name System configurations. It is commonly used by system administrators to automate or simplify routine DNS tasks, such as connectivity testing and network diagnostics, across a server environment.

What does CWE-77 mean for CVE-2026-35847?

CWE-77 refers to improper neutralization of special elements used in a command, often called command injection. In this CVE, the application fails to properly sanitize input before passing it to a system shell. This allows a user to supply malicious commands alongside expected parameters, causing the software to execute unintended instructions on the underlying operating system.

How is the ping function in CheckUtils.php triggered?

Exploitation requires a local attacker to interact directly with the CheckUtils.php script. The vulnerability is not triggered by standard network requests or remote service calls. It specifically requires an actor to have sufficient access to the local environment to invoke the function with manipulated input.

Is my system at risk if dnsmgr is not on the public internet?

According to Halo Surface Signal, this vulnerability is very unlikely to be reachable from the public internet. Because the bug requires local system access, common deployments that restrict host-level login or execute code in isolated environments significantly reduce the probability of successful exploitation.

What should I do if I find dnsmgr running?

Start by documenting where dnsmgr is installed and identifying who owns the application. Review your local access controls to ensure that only authorized, trusted users can execute scripts on those systems. Once you have a clear inventory and understand the business importance of the affected assets, coordinate with your infrastructure team to plan and test a transition to a secure, updated version.

References

github.com/freedom2132/CVE/tree/main

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.