CVE-2026-84887 - Vulnerability Details

- simular-ai Agent-S Model-generated GUI Action Execution Workflow grounding.py denial of service

Description

A vulnerability was identified in simular-ai Agent-S up to 0.3.2. Affected by this issue is some unknown functionality of the file grounding.py of the component Model-generated GUI Action Execution Workflow. The manipulation leads to denial of service. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Published: 2026-09-02

Score: 5.3 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A vulnerability exists in simular-AI Agent-S component Model-Generated GUI Action Execution Workflow, affecting all releases up to version 0.3.2. The flaw resides in the grounding.py module and can be manipulated to trigger a denial of service. An attacker can send crafted requests that cause unbounded resource consumption, rendering the affected component unresponsive. The issue is classified as a Resource Not Found weakness (CWE-404) and does not impact confidentiality or integrity.

Affected Systems

The product in question is simular-AI Agent-S, with vulnerable releases up to and including version 0.3.2 as identified by the CNA.

Risk and Exploitability

While the CVSS base score of 5.3 indicates moderate severity, the vulnerability is remotely exploitable and the exploit code is publicly available. The EPSS score is unknown, but the lack of a KEV listing suggests no confirmed field-of-view exploitation traffic yet. Administrators should not consider this a low‑risk event; the absence of a vendor patch and the persistence of the flaw make mitigation a priority.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

simular-ai

Agent-S

affected

Version	Status	Constraints
`0.3.0`	affected	—
`0.3.1`	affected	—
`0.3.2`	affected	—

No data.

Vendor Product Confidence Versions

Simular-ai

Agent-s

95%

Version	Status	Scheme	Platform
`0.3.0`	affected	semver	—
`0.3.1`	affected	semver	—
`0.3.2`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade simular-AI Agent-S to the latest version that resolves the grounding.py resource handling. If no patched release exists, contact the vendor for an interim fix or hold the upgrade.
Disable or isolate the Model-Generated GUI Action Execution Workflow component; for example, remove grounding.py from the deployment or place its execution behind a restrictive firewall to block external requests.
Implement rate limiting, input validation, and request throttling for transactions that invoke grounding.py to prevent repeated resource exhaustion attempts.

Generated by OpenCVE AI on September 3, 2026 at 10:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00332.

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/outlookgp/CVE/tree/main/AgentS_Action_Parameter_Budget_DoS_Report
https://vuldb.com/cve/CVE-2026-84887
https://vuldb.com/submit/886451
https://vuldb.com/vuln/398136
https://vuldb.com/vuln/398136/cti

History

Thu, 03 Sep 2026 13:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 02 Sep 2026 21:15:00 +0000

Type	Values Removed	Values Added
Description		A vulnerability was identified in simular-ai Agent-S up to 0.3.2. Affected by this issue is some unknown functionality of the file grounding.py of the component Model-generated GUI Action Execution Workflow. The manipulation leads to denial of service. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title		simular-ai Agent-S Model-generated GUI Action Execution Workflow grounding.py denial of service
First Time appeared		Simular-ai Simular-ai agent-s
Weaknesses		CWE-404
CPEs		cpe:2.3:a:simular-ai:agent-s::::::::
Vendors & Products		Simular-ai Simular-ai agent-s
References		https://github.com/outlookgp/CVE/tree/main/AgentS_Action_Parameter_Budget_DoS_Report https://vuldb.com/cve/CVE-2026-84887 https://vuldb.com/submit/886451 https://vuldb.com/vuln/398136 https://vuldb.com/vuln/398136/cti
Metrics		cvssV2_0 `{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:UR'}` cvssV3_0 `{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R'}` cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R'}` cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P'}`

Subscriptions

Simular-ai Agent-s

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-09-02T21:00:08.337Z

Updated: 2026-09-03T12:52:04.451Z

Reserved: 2026-09-02T14:16:09.268Z

Link: CVE-2026-84887

Vulnrichment

Updated: 2026-09-03T12:51:56.641Z

NVD

Status : Deferred

Published: 2026-09-03T05:16:47.333

Modified: 2026-09-03T17:25:25.113

Link: CVE-2026-84887

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-03T10:30:12Z

Weaknesses

CWE-404
Improper Resource Shutdown or Release

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

Exploitation poc

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object