ePO, ESM and DXL
CVE-2023-6071: Improper Neutralization of Special Elements used in a command in ESM
An Improper Neutralization of Special Elements used in a command vulnerability in ESM prior to version 11.6.9 allows a remote administrator to execute arbitrary code as root on the ESM.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| ESM Prior to version 11.6 | See the advisory |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
An Improper Neutralization of Special Elements used in a command vulnerability in ESM prior to version 11.6.9 allows a remote administrator to execute arbitrary code as root on the ESM. This is possible as the input isn't correctly sanitized when adding a new data source.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.