CVE-2026-25856: OpenBullet2 Authenticated Remote Code Execution Vulnerability

Technical summary

CVE-2026-25856 is an authenticated remote code execution vulnerability in OpenBullet2 affecting versions up to 0.3.2. The vulnerability stems from insufficient input validation and unsafe code execution in the job configuration handler. Specifically, the plain C# execution mode does not implement reference filtering or API restrictions, allowing an authenticated user to inject arbitrary C# code that executes with the privileges of the host process. An attacker can leverage reflection and .NET framework APIs to perform filesystem operations, process creation, and other system-level tasks. The vulnerability is classified under CWE-94 (Improper Control of Generation of Code).

Business impact

Organizations running OpenBullet2 face a significant insider threat if legitimate user accounts are compromised or if administrative trust is misplaced. An attacker with authenticated access can pivot from credential testing or configuration tasks into full server compromise, potentially leading to data exfiltration, malware deployment, or lateral movement within the network. The impact is particularly severe in multi-tenant or shared hosting scenarios where multiple users have administrative roles.

Affected systems

OpenBullet2 versions through 0.3.2 are vulnerable. Determine your current version and cross-reference against the vendor's version history. Installations running versions prior to the fix are at risk.

Exploitability

Exploitation requires valid authentication credentials to the OpenBullet2 application. The attack vector is network-based and does not require user interaction; an authenticated attacker can directly craft malicious job configurations. The low complexity and lack of compensating controls make this straightforward to exploit once credentials are obtained. The vulnerability is not currently tracked on CISA's KEV catalog, though that status may evolve as public awareness increases.

Remediation

Upgrade OpenBullet2 to a patched version beyond 0.3.2. Consult the official OpenBullet2 repository or vendor advisory to confirm the minimum safe version. Additionally, enforce strong authentication practices, limit administrative account distribution, and implement principle of least privilege for application user roles.

Patch guidance

Check the official OpenBullet2 project (verify against the vendor advisory or GitHub releases) for the first version that addresses this vulnerability. Apply the patch to all instances. If you maintain OpenBullet2 in a containerized environment, rebuild and redeploy images with the updated version. Test patches in a staging environment before production rollout.

Detection guidance

Monitor for suspicious job configuration submissions or modifications, particularly those containing C# code snippets or references to dangerous namespaces (System.Diagnostics, System.IO, System.Reflection, System.Net). Log authentication events and correlate them with unusual API activity. Network detection should flag attempts to access the job configuration endpoints with payloads containing executable code patterns. Examine audit logs for configuration changes made by unexpected user accounts.

Why prioritize this

This vulnerability merits rapid remediation because it provides direct, post-authentication code execution with full system access. The CVSS 3.1 score of 8.8 (HIGH) reflects high impact to confidentiality, integrity, and availability. Although authentication is required, credential compromise is common, and the vulnerability becomes critical in environments with weak access controls or high-trust user bases. Organizations should treat this as a priority patch.

Risk score, explained

The CVSS 3.1 base score of 8.8 is driven by HIGH ratings across confidentiality, integrity, and availability impacts. The attack vector is NETWORK, requiring no special network positioning. Attack complexity is LOW, indicating no special conditions are needed beyond valid credentials. Privileges required (LOW) means only authenticated access, which is often easier to obtain than system-level access. No user interaction is required, allowing silent exploitation. The vulnerability affects the integrity and confidentiality of the entire system.

Frequently asked questions