{"id":"CVE-2026-107459","published":"2026-10-08T06:16:42.000","lastModified":"2026-10-08T21:04:18.423","description":"The SecuShare Pro developed by Openfind has an OS Command Injection vulnerability. Unauthenticated remote attackers can inject arbitrary OS commands and execute them on the server.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://www.twcert.org.tw/en/cp-139-11255-bce41-2.html","tags":[]},{"url":"https://www.twcert.org.tw/tw/cp-132-11254-9c206-1.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The SecuShare Pro software has an OS Command Injection vulnerability, allowing unauthenticated attackers to inject and execute arbitrary commands on the server, leading to potential full server compromise.","exploitability":"Exploitation is relatively straightforward as it requires no authentication, and attackers can inject OS commands directly via remote access.","blast_radius":"If exploited, this vulnerability could result in complete control of the server, including data theft, service disruption, and further lateral movement within the network.","remediation":"Upgrade to the fixed version 2.590 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","os-command-injection","unauthenticated","web"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-08T08:40:54.007Z"}}