by Kastro
Paper/Archive/CVE-2026-5965

CVE-2026-5965

NewSoft NewSoftOA — NewSoft｜NewSoftOA - OS Command Injection

EPSS 2%CVSS 9.8
critical.is priorityof 100
45
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 76.4.764 × 2015.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

NewSoftOA developed by NewSoft has an OS Command Injection vulnerability, allowing unauthenticated local attackers to inject arbitrary OS commands and execute them on the server.

Affected

ProductAffectedFixed inSource
NewSoftOA< 10.1.8.310.1.8.3CNA

Scores by source

twcert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
twcert (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

writeuptwcert.org.tw/tw/cp-132-10856-4979f-1.htmlwriteuptwcert.org.tw/en/cp-139-10857-c46f7-2.html