A critical code injection vulnerability (CVE-2026-7703) has been discovered in AV Stumpfl Pixera Two Media Server up to version 25.2 R2. The flaw affects an unknown function within the WebSocket API component, allowing remote attackers to execute code injection attacks. The vulnerability can be exploited remotely and a public exploit has been published, making it actively exploitable. Users are strongly advised to upgrade to version 25.2 R3 or later to mitigate this security risk. The vulnerability poses a high risk due to its remote exploitability and the availability of public exploit code.