Termix is a web-based server management platform with SSH terminal

For the exact ID CVE-2026-45750, I could not corroborate a public NVD/GHSA advisory with affected version ranges or a fixed build in accessible sources as of 2026-06-05. Using your supplied intel only, the best-fit read is: Termix has a CWE-78 command injection path that is reachable over the web, but the vendor's own CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H says the attacker still needs a valid low-privilege account and a user interaction event.

That matters. Termix is a sensitive orchestration plane for SSH sessions, tunnels, file editing, and stored credentials, so impact can be ugly once an attacker is in. But PR:L + UI:R is not 'internet-to-root in one HTTP request'; it is a narrowed, post-initial-access path inside an admin workflow. Vendor CRITICAL 9.0 reads inflated for enterprise prioritization unless fresh evidence appears showing broad public exposure, easy weaponization, or active exploitation.

Why this verdict

• Downgrade for attacker position: PR:L means the attacker already has a foothold inside Termix. That is post-initial-access, not perimeter break-in.
• Downgrade for user interaction: UI:R compounds the friction. Someone has to open, click, import, preview, or otherwise trigger the bad path.
• Downgrade for exposure population: Termix is self-hosted niche admin software, not a ubiquitous internet-facing enterprise stack. The real-world reachable base is narrower.
• Hold at MEDIUM for blast radius: Termix is a credential-rich broker to downstream hosts. If the chain lands, the impact can jump beyond the web app into SSH-managed infrastructure.
• Downgrade for threat-intel silence: no KEV listing, no public exploitation evidence, no public PoC found, and the supplied EPSS is extremely low.

Why not higher?

I am not taking this to HIGH or CRITICAL because the chain appears to require both an existing authenticated position and a victim action. That is exactly the kind of compounded friction that breaks mass exploitation economics. Also, I could not corroborate public exploit material or an authoritative advisory for this exact ID.

Why not lower?

I am not dropping this to LOW because Termix is not just another dashboard; it is an access concentrator for SSH sessions, tunnels, and possibly stored credentials. A command-injection flaw inside that control plane can punch far above its initial foothold once triggered. Even with path friction, the downstream blast radius is real.

1. Restrict Termix to trusted networks — Put the web UI behind VPN, bastion access, or an identity-aware proxy and remove broad internet exposure where possible. For a MEDIUM verdict there is no mitigation SLA, but this is the best immediate risk reducer while you validate whether your deployment is affected and should still be completed within your normal hardening cycle.
2. Tighten RBAC and shared-object access — Reduce who can create or modify hosts, snippets, tunnels, file operations, and import/export workflows. This directly attacks the PR:L prerequisite by making low-privilege accounts materially less useful; for MEDIUM, there is no mitigation SLA — go straight to the 365-day remediation window, but apply this sooner if Termix is broadly shared.
3. Force SSO plus MFA for all human access — Move local accounts to IdP-backed auth where possible and require MFA on every administrative user. This helps prevent the initial authenticated foothold that the exploit path appears to require.
4. Watch the Termix host like a jump box — Put EDR and process telemetry on the Termix server or container host, and alert on unusual child processes from the app runtime, mass SSH activity, or unexpected shell invocations. This is how you catch the post-trigger phase when web-layer detection is weak.
5. Segment Termix from crown-jewel servers — Review which downstream hosts Termix can actually reach and trim network paths and stored credentials to the minimum set required. That limits the blast radius if the command execution lands.

Run this on the Termix server or Docker host, not from an auditor workstation. Invoke it as bash termix_cve_2026_45750_check.sh with normal shell access; sudo is only needed if Docker requires elevation. Because no authoritative public affected/fixed version range for CVE-2026-45750 was corroborated, the script is intentionally conservative and will output UNKNOWN unless Termix is absent.

#!/usr/bin/env bash
# termix_cve_2026_45750_check.sh
# Purpose: discover whether Termix is present and collect version context for CVE-2026-45750.
# Limitation: no authoritative public affected/fixed version range was corroborated as of 2026-06-05.
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0 PATCHED, 1 VULNERABLE, 2 UNKNOWN

set -u

found=0
version=""
source_hint=""

have_cmd() {
  command -v "$1" >/dev/null 2>&1
}

# Try Docker container metadata first
if have_cmd docker; then
  if docker ps --format '{{.Image}} {{.Names}}' 2>/dev/null | grep -qi 'termix'; then
    found=1
    source_hint="docker-running"
    # Best-effort image tag extraction
    version=$(docker ps --format '{{.Image}}' 2>/dev/null | grep -i 'termix' | head -n1 | sed 's/.*://')
  elif docker ps -a --format '{{.Image}} {{.Names}}' 2>/dev/null | grep -qi 'termix'; then
    found=1
    source_hint="docker-stopped"
    version=$(docker ps -a --format '{{.Image}}' 2>/dev/null | grep -i 'termix' | head -n1 | sed 's/.*://')
  fi
fi

# Try common install paths if Docker did not reveal anything
if [ "$found" -eq 0 ]; then
  for f in \
    /app/package.json \
    /opt/termix/package.json \
    /usr/local/share/termix/package.json \
    /var/lib/docker/volumes/termix-data/_data/package.json
  do
    if [ -f "$f" ]; then
      found=1
      source_hint="$f"
      version=$(grep -E '"version"' "$f" 2>/dev/null | head -n1 | sed -E 's/.*"version"[[:space:]]*:[[:space:]]*"([^"]+)".*/\1/')
      break
    fi
  done
fi

# Fallback: look for running process hints
if [ "$found" -eq 0 ] && have_cmd ps; then
  if ps aux 2>/dev/null | grep -i '[t]ermix' >/dev/null 2>&1; then
    found=1
    source_hint="process-scan"
  fi
fi

if [ "$found" -eq 0 ]; then
  echo "PATCHED"
  exit 0
fi

# No authoritative public fixed version for the exact CVE => conservative result.
# We intentionally do not guess vulnerability state from version strings.
printf 'UNKNOWN\n' >&1
{
  echo "detail: Termix detected"
  echo "source: ${source_hint:-unknown}"
  echo "version: ${version:-unknown}"
  echo "note: No corroborated public affected/fixed version range for CVE-2026-45750 as of 2026-06-05."
} >&2
exit 2

Sources

1. Termix repository
2. Termix product site
3. Termix releases
4. NVD: CVE-2026-42453 (adjacent public Termix command injection)
5. GitHub advisory: Termix Docker auth bypass CVE-2025-59951
6. CISA Known Exploited Vulnerabilities Catalog
7. Termix organization overview