Read the docs
TI-2026-69554 Aliases CVE-2026-107459

OS command injection in Openfind SecuShare Pro

Priority MEDIUM 51CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

Openfind SecuShare Pro from version 4 contains an OS command injection flaw (CWE-78). Special characters in input are not properly neutralized before being used in OS commands. An unauthenticated remote attacker can inject arbitrary OS commands and execute them on the server.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

The SecuShare Pro developed by Openfind has an OS Command Injection vulnerability. Unauthenticated remote attackers can inject arbitrary OS commands and execute them on the server.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01467 73rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenfindSecuShare Pro4—No fix listedCNA
  • SecuShare Pro VendorOpenfind Affected 4 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for SecuShare Pro.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

  1. 2026-10-08 Threatist record created from CVE-2026-107459

References

Other 2

  • TI-2024-05604 Openfind MailGates and MailAudit - OS Command Injection CVSS 3.1CRITICAL 9.8
  • TI-2026-05571 Openfind｜MailGates/MailAudit - Stack-based Buffer Overflow CVSS 4.0CRITICAL 9.3
  • TI-2020-10167 Openfind MailGates - Command Injection CVSS 3.1CRITICAL 9.8
  • TI-2026-05572 Openfind｜MailGates/MailAudit - CRLF Injection CVSS 4.0HIGH 8.7
  • TI-2020-15840 Openfind MailGates/MailAudit - Command Injection CVSS 3.1HIGH 8.8
  • TI-2024-05016 Openfind Mail2000 - OS Command Injection CVSS 3.1HIGH 8.8
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences