A flaw in the HTTP request handler of Topsec's TopACM 3.0 allows an attacker to inject arbitrary operating‑system commands via the template_path parameter in nmc_sync.php. This leads to remote code execution on the affected server. The vulnerability corresponds to CWE‑77 and CWE‑78 and can compromise confidentiality, integrity, and availability of the system.

The issue affects the Topsec TopACM product, version 3.0, specifically the file /view/systemConfig/management/nmc_sync.php within the HTTP Request Handler component. No other versions are listed, so all installations of TopACM 3.0 that expose this endpoint should be considered vulnerable.

The CVSS v3.1 score of 9.3 indicates critical severity, while the EPSS score of less than 1% suggests current exploitation probability is low. The exploit is publicly available, and the attack can be performed remotely, though the description does not specify whether authentication is required, so the relevance of credential or administrative access remains uncertain. The vulnerability is not included in the CISA KEV catalog. Given the high severity and public availability, the risk is significant for any system exposing nmc_sync.php to external traffic.