CVE-2026-88260

Brainzcompany Zenius EMS 8.0 contains two flaws that combine to enable remote code inclusion: an authentication bypass using an alternate path or channel (CWE-288) and improper validation of the syntactic correctness of input (CWE-1286). Per the CVSS 4.0 vector (adjacent attack vector, no privileges or user interaction required), an attacker with access to a network adjacent to the EMS server can reach the application, bypass authentication via the alternate path, and submit malformed input that the application accepts, causing it to include and execute attacker-controlled remote code. Successful exploitation carries high impact to confidentiality, integrity, and availability on the EMS host, with an overall CVSS 4.0 score of 8.7 (High). All Zenius EMS 8.0 deployments up to and including OAM (Build 109) are affected, so any organization running that release should treat itself as potentially exposed. There is currently no public proof-of-concept, no CISA KEV listing, and no confirmed exploitation in the wild.

What to do: Upgrade Zenius EMS 8.0 to the first build after OAM (Build 109) once Brainzcompany publishes a fixed release, and verify your currently deployed build. Until patching, restrict network access to the EMS server to trusted management segments, since exploitation requires adjacent-network access but no credentials or user interaction. No public PoC or KEV listing exists yet, so prioritize the upgrade on exposed management networks and monitor for vendor advisories or future KEV inclusion.