EIP-2026-114795

This advisory details an OS command injection vulnerability in Oracle VM Agent 2.3, where the `validate_master_ip` function fails to sanitize the `proxy` parameter, allowing remote command execution as root via XML-RPC. The technical description includes a crafted POST request demonstrating the exploit.