Is CVE-2026-43943 actively exploited?

No active exploitation of CVE-2026-43943 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-43943 be exploited remotely?

No. CVE-2026-43943 requires local access to exploit.

What is the CVSS score of CVE-2026-43943?

CVE-2026-43943 has a CVSS score of 7.8 (HIGH).

HOME VULNERABILITIESCVE-2026-43943

HIGH

CVE-2026-43943

CWE-78Published: May 8, 2026· Updated: May 8, 2026

7.8

CVSS v3.1

EPSS:0.03%probability of exploitation in 30 daysPercentile:8.7th

Official Description

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to version 3.7.9, a code execution (RCE) vulnerability exists in electerm's SFTP open with system editor or "Edit with custom editor" feature. When a user opts to edit a file using open with system editor or open with a custom editor, the filename is passed directly into a command line without sanitization. A malicious actor controlling the SSH server or user OS can exploit this by crafting a filename containing shell metacharacters. If a victim subsequently attempts to edit this file, the injected commands are executed on their machine with the user's privileges. This could allow the attacker to run arbitrary code, install malware, or move laterally within the network. This issue has been patched in version 3.7.9.

NVD Source

Technical Analysis

CVE-2026-43943 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 7.8.