# CVE-2018-11139: CVE-2018-11139

- Exploited (CISA KEV): no
- Published: 2018-05-31
- CVSS: not scored
- EPSS: 42.4% (99th percentile)

The '/common/ajax_email_connection_test.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by any authenticated user and can be abused to execute arbitrary commands on the system. This script is vulnerable to command injection via the unsanitized user input 'TEST_SERVER' sent to the script via the POST method.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | Before feed history | — | — |
| AWS | Before feed history | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | Before feed history | — | — |
| Fastly | Before feed history | — | — |
| F5 | Rule published | 2025-12-03 | 2743 |
| Akamai | No public source | — | — |
| OWASP CRS | Before feed history | — | — |

### F5

- 2025-12-03 · new · rule 200103668
  > Added: signature 200103668 "Quest KACE System Management Remote Code Execution (1)" (Command Execution, risk High), systems: PHP. References: CVE-2018-11139.
  Source: https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2018-11139 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2018-11139