Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.4
CVE-2026-104383: EagleCloud Aquila on‑premises lets attackers run code
CVE-2026-104383 · published 12 days ago
Summary
The on‑premises version of EagleCloud Aquila (up to 2.6.7.2) can be tricked by a signed‑in user into running their own commands. This means an attacker who already has a user account could take control of the server and manipulate data or services. Apply the vendor’s latest security update or upgrade to a newer version to close the gap.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| eaglecloud | aquila | <= 2.6.7.2 |
Original advisory text
Code injection in EagleCloud Aquila on-premises version
Improper Control of Generation of Code in Pigeon MFA service in EagleCloud Aquila versions through 2.6.7.2 on on-premises platforms allows authenticated remote attackers to execute arbitrary code via code injection
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
9.4
Critical
Type
CWE-94Code Injection
Timeline
Published28 Oct 2026
Updated6 Nov 2026
First seen28 Oct 2026
Track software like this
Free during beta