Critical 9.8 CVSS Flaw in Pharos Mosaic Controllers Grants Root Access to Unauthenticated Attackers

CISA and Pharos Controls published an advisory for CVE-2026-2417, a critical (CVSS 9.8) "Missing Authentication for Critical Function" vulnerability in Mosaic Show Controller firmware 2.15.3 that allows unauthenticated remote attackers to execute arbitrary commands as root; administrators are urged to upgrade to firmware 2.16 or later and to ensure controllers are not exposed directly to the internet.