CVE-2026-18993
Full vulnerability record from the local CVENow database.
Description
A vulnerability was detected in NousResearch hermes-agent up to 0.16.0. Affected by this issue is some unknown functionality of the file hermes-agent/model_tools.py of the component Memory Toolset. The manipulation results in improper access controls. The attack can be executed remotely. The exploit is now public and may be used.
Severity
LOW
CVSS score
2.1
(v4.0)
Vulnerability status
Deferred
Source identifier
Published
2026-08-06 05:16:41.380000
Last modified
2026-10-23 21:10:00.157000
View original CVE JSON
{
"id": "CVE-2026-18993",
"sourceIdentifier": "[email protected]",
"published": "2026-08-06T05:16:41.380",
"lastModified": "2026-10-23T21:10:00.157",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in NousResearch hermes-agent up to 0.16.0. Affected by this issue is some unknown functionality of the file hermes-agent/model_tools.py of the component Memory Toolset. The manipulation results in improper access controls. The attack can be executed remotely. The exploit is now public and may be used."
},
{
"lang": "es",
"value": "Una vulnerabilidad fue detectada en NousResearch hermes-agent hasta 0.16.0. Afectada por este problema es alguna funcionalidad desconocida del archivo hermes-agent/model_tools.py del componente Memory Toolset. La manipulación resulta en controles de acceso inadecuados. El ataque puede ser ejecutado remotamente. El exploit es ahora público y puede ser usado."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "NousResearch",
"product": "hermes-agent",
"cpes": [
"cpe:2.3:a:nousresearch:hermes-agent:*:*:*:*:*:*:*:*"
],
"modules": [
"Memory Toolset"
],
"versions": [
{
"version": "0.1",
"status": "affected"
},
{
"version": "0.2",
"status": "affected"
},
{
"version": "0.3",
"status": "affected"
},
{
"version": "0.4",
"status": "affected"
},
{
"version": "0.5",
"status": "affected"
},
{
"version": "0.6",
"status": "affected"
},
{
"version": "0.7",
"status": "affected"
},
{
"version": "0.8",
"status": "affected"
},
{
"version": "0.9",
"status": "affected"
},
{
"version": "0.10",
"status": "affected"
},
{
"version": "0.11",
"status": "affected"
},
{
"version": "0.12",
"status": "affected"
},
{
"version": "0.13",
"status": "affected"
},
{
"version": "0.14",
"status": "affected"
},
{
"version": "0.15",
"status": "affected"
},
{
"version": "0.16.0",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 2.1,
"baseSeverity": "LOW",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "PROOF_OF_CONCEPT",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 2.8,
"impactScore": 3.4
}
],
"cvssMetricV2": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "2.0",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"baseScore": 6.5,
"accessVector": "NETWORK",
"accessComplexity": "LOW",
"authentication": "SINGLE",
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"availabilityImpact": "PARTIAL"
},
"baseSeverity": "MEDIUM",
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"acInsufInfo": false,
"obtainAllPrivilege": false,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-08-06T13:27:20.784017Z",
"id": "CVE-2026-18993",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-266"
},
{
"lang": "en",
"value": "CWE-284"
}
]
}
],
"references": [
{
"url": "https://github.com/NousResearch/hermes-agent/",
"source": "[email protected]"
},
{
"url": "https://github.com/NousResearch/hermes-agent/issues/46171",
"source": "[email protected]"
},
{
"url": "https://github.com/NousResearch/hermes-agent/issues/48181",
"source": "[email protected]"
},
{
"url": "https://github.com/NousResearch/hermes-agent/pull/46185",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/cve/CVE-2026-18993",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/submit/862610",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/386377",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/386377/cti",
"source": "[email protected]"
}
]
}