CVE-2026-63722 covers a high-impact remote code execution issue in ICEcoder, a browser-based code editor used to manage files and terminal operations on web servers.
The vulnerability stems from a chained control failure: authentication checks can be bypassed, CSRF validation can be skipped, and command input reaches process execution without adequate sanitization. In combination, these weaknesses allow an unauthenticated network attacker to run arbitrary operating-system commands in the context of the web-server user.
For organizations running ICEcoder in internet-reachable or poorly segmented environments, the practical risk is full host compromise of the application server. Evaluris recommends treating exposed instances as high priority for isolation, upgrade, and verification against the official CVE record and vendor guidance.