A flaw exists in the evalIsFailed method of GroovyScriptImpl.java that allows an attacker to execute arbitrary operating‑system commands. The publicly available exploit demonstrates that invocations can be made remotely through the Groovy Script handler in sonic‑agent. Based on the method name and typical behavior of Groovy’s eval function, it is inferred that user input is evaluated directly without proper sanitization, enabling the injection. This weakness corresponds to CWE‑77 and CWE‑78 and can lead to compromise of the host on which the agent runs.

SonicCloudOrg sonic-agent releases up to and including version 2.7.2 are impacted. The vulnerability only applies to editions that are no longer supported by the maintainer; newer supported releases are not affected.

The CVSS score of 5.3 indicates a moderate risk level. The EPSS score of 1% shows a low but non‑zero likelihood of exploitation. The existence of a public exploit suggests that real‑world exploitation potential may exceed the nominal score. The vulnerability is not listed in the CISA KEV catalog. Attackers can launch the exploitation remotely, which raises the urgency for contained mitigations.