9.4
CriticalCVSS 4.0 · from Mandiant
CVE-2026-104383
Code injection in EagleCloud Aquila on-premises version
Aquila · Code injection · CWE-94AffectedAquila
FixNo fix listed yet.
PublishedOct 28, 04:21 · Mandiant
ScoredOct 28 · 9.4 · Mandiant
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:09 UTC
What we know
No known exploitation. CISA KEV, checked 22:09 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, low privileges.
A successful attack can read and change data and take the service down. CVSS: high impact on confidentiality, integrity and availability.
Description
Improper Control of Generation of Code in Pigeon MFA service in EagleCloud Aquila versions through 2.6.7.2 on on-premises platforms allows authenticated remote attackers to execute arbitrary code via code injection
From Mandiant
Affected and fixed versions
ProductAffectedFixed inAquilaup to 2.6.7.2–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known