Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Samsung QA-Board lets attackers run commands without login

CVE-2026-110392 · published today
Summary

The Samsung Open Source QA-Board web tool can be tricked into executing operating‑system commands without any authentication. This could let an attacker control the server, steal data, or disrupt services. Apply the vendor’s security patch or limit access to the application until it is updated.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
samsung open source qa-board All versions
Original advisory text
Samsung QA-Board — Unauthenticated OS command injection via output redo/tuning
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Samsung Open Source QA-Board allows : OS Command Injection.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Type
CWE-78OS Command Injection
Timeline
Published14 Oct 2026
Updated14 Oct 2026
First seen14 Oct 2026
Sources
CVE-2026-110392 · NVD
CVE-2026-110392 · MITRE
Track software like this
Free during beta