External risk intelligence

Remote Unauthenticated Code Execution on Agent Host

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-64633

The vulnerability affects an agent host and allows for remote unauthenticated code execution. Agents are commonly deployed across network infrastructures to communicate with central management systems, often traversing network boundaries and exposing them to external or semi-external reachability in typical deployment architectures.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified that could allow for remote, unauthenticated code execution on agent hosts, a significant concern due to the widespread deployment of agents across network infrastructures. The main concern at this stage is confirming the relevance and exposure of this issue within our environment.

Allows remote attackers to execute code.
Agents are deployed widely, increasing potential impact.
Confirm relevance and exposure within our systems.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted data over the network to a vulnerable agent. This could allow them to execute arbitrary code on the agent host without any prior authentication.

Network exposure required.
Triggered by network data.
Remote unauthenticated code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated remote attacker to execute arbitrary code on the agent host. This means an attacker could potentially take control of the agent and any systems it has access to.

Agent host system compromised.
Remote, unauthenticated code execution is possible.
Complete compromise of the agent's access.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects an agent host and allows for remote, unauthenticated code execution. Responsibility likely falls to the team managing the agent infrastructure, with initial steps involving identifying all agent deployments, assessing their network exposure and business criticality, and locating the accountable owner to plan remediation.

Infrastructure or platform teams own the issue.
Verify agent network reachability and criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the agent host software mentioned in CVE-2026-64633?

This software refers to an agent component typically installed on hosts to facilitate communication with a central management system. These agents act as intermediaries, allowing administrators to monitor, manage, and perform tasks across distributed network infrastructures from a single control point.

What does CWE-94 mean in the context of this vulnerability?

CWE-94, or Improper Control of Generation of Code, occurs when software allows an attacker to influence or control the execution of code. For CVE-2026-64633, this means a remote user can send specific data that the agent incorrectly processes, leading the system to execute unauthorized commands as if they were legitimate instructions.

How is this vulnerability triggered by an attacker?

An attacker triggers the vulnerability by sending specially crafted data packets over the network to a vulnerable agent. The flaw is not triggered by local user actions or physical access; it requires the agent to be reachable via a network connection that allows the delivery of this malicious data.

Is my environment at risk according to Halo Surface Signal?

Halo Surface Signal identifies this as a 'Likely' risk because agents are frequently deployed across network boundaries to communicate with management systems. Because this architectural design often places agents in positions where they are accessible from external or semi-external networks, they are more susceptible to remote exploitation than internal-only components.

What should I do if I am running this agent software?

Your first step is to inventory all deployments of the agent within your infrastructure to understand your footprint. Once identified, evaluate the network reachability of these agents to determine if they are exposed to external traffic, assess their business criticality, and coordinate with the team responsible for managing the agent infrastructure to prepare for updates.

References

www.veeam.com/kb4892

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.