Cybersecurity firm XBOW disclosed a critical, unauthenticated remote code execution vulnerability in a public web application operated by the US Election Assistance Commission (EAC). The affected application handles resource and logistics calculations and is not part of voting machines or voter registration systems. The flaw could have allowed attackers to execute code with root privileges inside a backend container through crafted web requests, potentially accessing locally protected resources and external networks. XBOW reported the issue under the EAC's published vulnerability disclosure policy, and the commission verified and fixed the vulnerability before the US federal midterm elections.