{"cvss":9.3,"datePublished":"2026-09-18T00:00:00Z","dateUpdated":"2026-09-18T00:00:00Z","description":"AutoAgent contains an unauthenticated remote code execution vulnerability in the TCP server that binds to all interfaces and executes attacker-supplied commands as root. Attackers can connect to the exposed communication port and execute arbitrary bash commands within the container, gaining access to bind-mounted host workspace directories.","dueDate":"","id":"CVE-2026-86124","kev_catalogs":["vulncheck"],"knownRansomwareCampaignUse":"Unknown","product":"AutoAgent","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","severity":"CRITICAL","source":"vulncheck_kev","title":"  Missing Authentication for Critical Functionality","vendor":"HKUDS"}